Apparently you have to remove IPSEC from fasttrack rules - http://forum.mikrotik.com/t/privateinternetaccess-com-ipsec-ike2-config-with-port-forwarding/131568/1
To summarise;
#Mangle rules to identify IPSEC traffic
/ip firewall mangle add action=mark-connection chain=forward ipsec-policy=out,ipsec new-connection-mark=ipsec
/ip firewall mangle add action=mark-connection chain=forward ipsec-policy=in,ipsec new-connection-mark=ipsec
If you have a fasttrack rule already, under general, Connection Mark (!) ipsec. Or to add the rule
/ip firewall filter add action=fasttrack-connection chain=forward connection-mark=!ipsec connection-state=established,related
Made a huge difference to my connection.