Thank you for sharing the results. As expected, IPSec is much harder on CPU without hardware acceleration. Your earlier screenshot for WireGuard shows unclassified 13 + wireguard 4 = 17%. It’s not clear how much of this unclassified is from WireGuard, probably most of it. Even if we count all 17%, that’s still a lot less than 40.5% on encrypting IPSec.