How to prevent conntrack overflow on host with many qemu guests

Is there any way to make iptables conntrack use separate data structures for each network interface? Would network namespaces help here (put each guest together with its tap device in its own netns and do the ipfilter conntrack inside that netns), or do they share the same data structures under the hood?

Background information: I'm running many qemu guests with ech guest having its own tap device on the host for networking. For firewalling of the guests I use iptables on the host with connection tracking enabled (I cannot do the firewalling inside the guests). However a single (very busy) guest can overflow the conntrack table on the host. As this table is shared among all guests (and the host) this can render the whole host/ guests unreachable because the host starts dropping packets/ connections.