Just an update here for anyone interested. After extensive tweaking and simplification of the config, we've managed to extract around 680mbit/sec out of the two RB1100AHx2 routers (including clocking them up to 1333MHz).
We bought 2xCCR1009s for another project, and decided to see how fast they would work for this particular requirement. We copied the config across, and the performance sucks. We were only able to get 25mbit/sec with the same config. It seems as soon as you combine EoIP or other tunneling with IPSec on the CCR series, the performance drops dramatically. Bandwidth test between the EoIP endpoints runs 600M+, and if you disable the encryption, EoIP runs at 900M+, but when you combine them, the performance drops to 25
We tried fiddling with MTU, MSS clamping, changing ports etc, but could not fix the problem, so it looks like the 1100s will have to do for now.
Mikrotik, how about an updated PPC model with higher clock speed?