Normal for the Arris E6k platform, though nothing to do with 16 downstreams per se. Even if you had one downstream locked you'd see much the same.
There is a need for it if no alternative steps are taken - there's no mapping between downstream groups and IP addresses so broadcasts for all IP scopes have to be sent down all downstream groups. Your devices are not connecting to VM via a layer 3 segmented network, you are on a nice, big broadcast domain for layer 2 purposes
