Instead of collecting various logs into the SIEM, can a full packet capture solution be better in terms of having to manage so many log sources?
Just by capturing the full traffic the task does not magically gets less complex. The traffic still needs to be processed and the information extracted. In contrary, capturing all traffic inside a huge network and processing it in real-time is a huge task: there is lots of bandwidth needed to collect all traffic in the first place and huge processing power needed to process it.
It scales much better to extract the relevant information as soon as possible from the network and only feed the pre-processed information into the SIEM. Apart from that SIEM usually not only get information from the network traffic, but also include information from the endpoints, like which applications are running and what they are doing, authentication errors etc. This is the kind of information which cannot be directly derived from the network traffic.
There is solutions such as moloch, or commercial ones that can store pcaps at big scale, however as Steffen mention the system will need a lot of resources, what the majority of the systems do is use netflow data is you can summarize as an abstraction of the flow and send this data to the SIEM system. Of course if you want to be granular you will need a solution that will take the pcap files but in the majority of the cases by feeding with netflow data the SIEM will be fine.