phascogale
Strange, but with Mikrotik you never know.
Well, you updated it (why?) to 7.20.6.
Imagine to go back around 2006/2007, when you had an "average" computer running Windows XP just fine and you decided to upgrade it to Vista, you would have been instantly transported in a world where everything is slower, if you are too young for that imagine that your swimming pool has been filled with molasses instead of water ...
The RB941-2nd aka hap Lite is a now showing its age and the specific device model has never been a "powerful" one.
Since you don't need the added features of v.7 you should (IMHO) downgrade to latest v6 (6.49.18 if I recall correctly).
About speed, you are seemingly using the device as router, whilst I thought (in my perverted mind) you could use it configured as switch/bridge, but maybe I did not get all the requirements correctly, the firewall and natting do increase CPU usage, and the single radio (through the workaround of the two interfaces on it, one master and one slave or one "real" and one "virtual") is transmitting half the time and receiving the other half of the time.
The hAp lite (that I presume will be going soon in the "Discontinued" bin) is 25 $/€ list price, they can often be found for less, the AC lite is 59$/€ an alltogether different price level. In any case this latter still has 16 Mb storage that is simply "not enough" for v7 (though it has 64 Mb Ram which is double the - inadequate - 32 Mb the hap lite has).
For the same $/€ 59 you can get an Ax Lite that has 128 Mb storage and 256 Mb RAM, this is adequate to run v7 (but still has a single 2.4 GHz radio).
All this said, I don't believe that there is anywhere (yet) a local wi-fi that is only 5 GHz, some 2.4 GHz should be available everywhere and you don't need much speed, so the "right" device for you would be (IMHO) a mAP $/€45 which is essentially a smaller hap lite with only two ethernet ports, running v6.
As a matter of fact, there is another device (now discontinued) but some batches can still be found (with street prices below the 20$/€ mark), the hap Mini that could be suitable (still running v6).
Choosing the device depends also on how many of these devices you need, a device "born" with v7 such as the Ax lite is an investment in the future, it runs V7 decently, has ARM processor, plenty of storage and ram (more than actually strictly needed) while still having a decent price.
Now about your configuration, at first sight (and with all due respect 
) it sucks 
.
You EITHER need a firewall OR you don't.
If the first, don't try to be clever, start from the DEFAULT firewall, that would be Rule #8
The twelve Rules of Mikrotik Club
As is the default firewall will be 99% good and you can make MINOR modifications to it to adapt it to your needs.
The "proper" ways to make an off bridge port are described here (no need for a specific ether4 firewall rule, interface lists are used instead):
Once and for all COMPLETE Offbridge Port setup