My comparison with fw + nat + mangle + ipsec shows that ax2 performs worse than ac2 or ac3.
You shouldn’t consider of buying ac2 due to insufficient flash size for ros 7 (16mb)
Only ac3 (128mb).
My humble opinion: ax2 cpu arm64 surely faster than ac2\ac3 cpu arm32.
But ros 7 not optimized for ax2 better performance.
So right now ac3 performs faster.
And 4011 faster than ax2 \ ac2 \ac3 for my tasks.
Consider of buying used 4011.