"nginx recompile, because the module could be still hooking in requests."

security_mod disabled it not tracker after any domains on the server it cant hooking requersts if it not tracking after domains
becuse memory leaking only when clients do traffic with domains.

i for sure now it not security_mod problem and about version i use mod_security it last one
Current rules version 1.11 (Latest version)
CWAF plugin version 2.11 (Latest version)

i thinking of php-fpm problems with nginx, i google a little and saw people complain about leaking in nginx who have php-fpm