Where is the correct place to set net.netfilter.nf_conntrack_buckets?

I think that sysctl parameter is for viewing only. You'll want to use the /sys/module/nf_conntrack/parameters/hashsize interface for runtime changes, and the hashsize module option to set it during initial module load.

You'd want an entry in a /etc/modprobe.d/ file that looks something like this:

options nf_conntrack hashsize=XXXXX

Further to Andrew B's answer:

For some reason, the RHEL documentation recommends putting an executable shell script with a name like nf_conntrack_hashsize.modules extension into /etc/sysconfig/modules instead. I have no idea why. Contents would look like:

#!/bin/sh
exec /sbin/modprobe nf_conntrack hashsize=262144

You need to put a file called, for example, localhost inside /etc/modprobe.d/ directory.

Inside this file, add these lines (value is an example):

options nf_conntrack hashsize=333333

And now, the more quick solution is a restart, the other option is to try a reload the nf_conntrack kernel module, wich is a bit difficult because it's linked with others running modules.

Check the result with:

cat /sys/module/nf_conntrack/parameters/hashsize