Does anyone know what the real numbers are, and what numbers are feasible and what numbers aren't?
Not me. But if blocking large amount of subnets and host addresses is your issue here. Only one rule is sufficient. See ipset 2.0
http://people.netfilter.org/kadlec/ipset/
Sorry if am out of topic.
Samuel
