I was looking at our DNS traffic on the syslog boxes and it seemed to be more than I would expect. I bumped up the dns_cache value which definitely helped, and now the vast majority of queries seem to return NXDomain.  So my question is, does syslog-ng not have a negative DNS cache?  The version that I tested this on was syslog-ng-3.37.1-1.el7 on RHEL7.