It all depends on the requirements and apart from VPN using Wireguard or IPSEC, none have been given.
For both VPN options, all MT devices can do this (ROS7).
Wireguard is always a SW solution. Some devices can use HW offload for IPSEC (depending on used encryption method).
But even then some routers are still faster using Wireguard then IPSEC with HW Offload.
You may even throw Zerotier in the mix ? (ARM/ARM64 devices only)
Other things to consider:
- added ethernet ports needed ?
- Wifi needed or not ?
- USB storage needed or not ?
...
Requirements. They are not clear now.
And probably that's why there is such an overwhelming response to the initial question