MarkLogic recommends that the Security database only have 1 primary forest.  Having more than one primary forest for the Security database can cause failover issues when doing upgrades and restarts.  The Security database should have a single primary forest, and one replica forest to support High Availability.

More details available in the knowledge base article How many forests should my Security database have?

Refer to our documentation for Configuring the Security and Auxiliary Databases to Use Failover Forests