It might be probable that the IPsec test results posted on the hAP ax² page were actually measured with the hAP ax³ because the IPsec numbers are exactly the same!
But the ax² is clocked way slower than the ax³ and the benchmarks from a recent thread showed that the raw CPU power is only about 48% that of the ax³.
Maybe you can reach the published 550 Mbps number with AES-256CBC if you use the hAP ax³? And the half of that number is inline with your ax² measurements?