If you just specify the ipsec-secret value on the /interface eoip configuration row, RouterOS dynamically generates the IPsec configuration (peer, identity, policy) using the peer profile called default and the proposal called default.

So if you don't plan to use this profile and proposal for other purposes, you can accommodate them to your needs. If you want to keep them unchanged, the simplest approach is to

• create your own profile and proposal (let's say my-profile and my-proposal)
• set the ipsec-secret value on the /interface eoip configuration row so that RouterOS generated the IPsec objects
• create static copies of those objects with modified parameters:
  /ip ipsec peer add copy-from=[find where dynamic] profile=my-profile name=my-eoip address=127.0.0.127
  /ip ipsec identity add copy-from=[find where dynamic] peer=my-eoip
  /ip ipsec policy add copy-from=[find where dynamic] proposal=my-proposal peer=my-eoip
• unset the ipsec-secret on the /interface eoip configuration row
• set the actual peer address on the static peer:
  /ip ipsec peer set my-eoip address=the.actual.peer.address

For road warriors, you get less headache if you use tunnel mode of the SA and create an individual identity referring to an individual policy template group for each road warrior. That way, you can use static private addresses at both ends for the EoIP tunnel although the WAN addresses of the road warriors are unknown in advance. It will cost you one more IP header in each packet.

But to use EoIP on a road warrior is kind of an act of desperation, L2 protocols are quite unhappy with long round-trip delays.