Try adding an exception IPsec policy for local traffic from the router to the LAN devices as described here. Without this policy, PMTUD does not work so many TCP connections won’t be able to deliver data unless you use action=change-mss rules in mangle to manually adjust the MSS to match the actual MTU of the IPsec-encrypted packets.