You can get RB951G which is twice as fast as RB751G and in the same price range. It should handle fine 20Mbps half-duplex.
Check performance on RB751G on lower traffic mark, check CPU usage. You will get twice as that on RB951G.
FYI, it is unlikely that a 951G can do 20M half duplex, it's more like 12-15Mbps real world. I have deployed 50+ 751G and 951G and get at most 8/12Mbps respectively out of them with aes-128 ipsec. This works well for me though as I rarely need more than that across the VPN tunnels, the router is still able to deliver WAN traffic to users well. I've also had good luck with the 2011 series, but dont have too many out there yet.
The 1100AHx2 is next in line. It would be nice to have an in-between unit with a 1Ghz CPU, or dual core, or some other aes hardware onboard. for example, ubiquiti's ERLite can do 100Mbps+ aes128. Unfortunately, ubiquiti's ERLite's OS just isn't as robust as RouterOS. I have used ERLites for 'dumb' VPN setups, even adding them specifically for ipsec tunnels between sites and using a 'tik for the actual router.