Hi! Happy new year and thank you very much for the support! 
It was indeed a MTU issue!
Looking for "NordVPN + MTU" keywords in the forum I jumped into this old post:
https://forum.mikrotik.com/t/mtu-troubles-using-ikev2-providers-like-nordvpn-work-around/
The workaround proposed there still works:
/ip ipsec policy
move *ffffff destination=0
add action=none dst-address=192.168.88.0/24 src-address=0.0.0.0/0 place-before=1
with 192.168.88.0/24 replaced by my subnet.
This even solved my smartTV connectivity problems.