Hi Gerd, thanks for your report. Can you please share your configuration?

You can increase maximum concurrent queries by dns-forward-max=300 directive. Each query should be freed after 40 seconds. If your workstation time does not go backwards, it should appear only for short time.

Can you please check by tcpdump or similar that queries are not made in high numbers?

Can you try sending 
$ killall -s USR1 dnsmasq

and include its output from journalctl? Before lags and after they start if possible?

I think I have found a fix that would work.

Summary from private comments is this:
main dnsmasq instance listening on localhost uses forwarders for specific domains. One of that domains is forwarded to libvirt (another) dnsmasq instance handling names of virtual machines. Known hosts work well. However unknown names are forwarded back to the system forwarder. Which is dnsmasq listening on localhost. That forwards it again to libvirt instance, creating unending loop.

localhost configuration includes something like:
server=/sirius.example.org/192.168.105.1
rev-server=192.168.105.0/24,192.168.105.1

on 192.168.105.1 is listening dnsmasq instance of libvirt.

You want to prevent looping of unhandled dns names back. I think it you can fix it by change of libvirt configuration.

edit libvirt network definition by
$ virsh net-edit default

then add into tag <network> (not <ip>) something like this:
  <dns>
    <forwarder addr='127.0.0.1'/>
    <forwarder domain='sirius.example.org'/>
    <forwarder domain='105.168.192.in-addr.arpa'/>
  </dns>

that would forward all queries to localhost instance, but do not forward anything from domains without addr. Registered hosts would be correctly handled, others would receive correct answer NXDOMAIN from dnsmasq of libvirt.

I haven't checked if Petr's suggestion will work, but jdenemar solved this in his similar setup by adding the "localPtr" attribute to libvirt networks' <ip> element. For example:

   <ip address='192.168.105.0' netmask='255.255.255.0' localPtr='yes''/>

dnsmasq only responds to PTR record requests for ip addresses that are *currently assigned to a client* and will normally forward requests for currently unassigned addresses to the upstream DNS server. But when localPtr is yes for an address range, it will respond with a failure rather than forwarding the request upstream. This behavior is achieved by libvirt adding (in the case of the above example) the following to the dnsmasq.conf file:

   local=/105.168.192.in-addr.arpa/

Whenever you have the upstream DNS server on the host setup to potentially forward to a libvirt network's DNS, you should always add localPtr='yes' to the libvirt network's <ip> elements (and also add "localOnly='yes'" to any <domain> element defined in the network).

I'm assuming that making these changes to your network will solve the problem, and closing this as NOTABUG. If the problem persists, then please re-open.