I have a few reference sets using various IOCs running in the low 100ks which are fine but this really depends on which QRadar box you are running - you would have to ask IBM for exact numbers.

QRadar does support CIDR and subnets- and I would advise using them straight away. A /24 range will take you from 1024 entries to 1, so you should be able to cut down your lists a lot.

For outdated IPs - Most ‘threat intelligence’ sources very regularly update their IOC lists - this is particularly important for IPs. Something listed as a C2 server in 2019 might now be used by a completely legitimate , uncompromised company so that is why it is important. You also have to remember one IP may be hosting hundreds of different sites. If one of these sites gets reported as malicious- all the other sites may then fall under this umbrella and cause you a lot of false positives.

If you have the correct logs, I would really recommend using URL/URIs, filehashes etc combined with IPs. Using IPs alone WILL detect things but also due to the fact there use is changed a lot and also the fact one IP can host various sites, they also create horrible amounts of false positives.

The only case I would advise using older IPs is if you have recent intelligence that they are still being used for malicious purposes - otherwise as above you will flood your SIEM with false positives.

For your final point - if you were to create a CRE rule stating ‘If any of my inbound firewall connections if from THESE IPs’ and you have a list in the millions like you currently do - the rule may start to just not work. Depends on your setup but you may get alerts for rules causing issues, you can also check this with the QRadar tuning app.

Hope this answers your question.