Before I start, I know I am going to get a lot of replies saying 'use a proper router' or 'get something that does IPSEC in hardware' but ...

I have a requirement for a very low bandwidth IPSEC tunnel for simple SSH access to a device plugged into a CRS305 switch. I know the CRS is not designed for any significant routing / tunnelling, and that all packet processing for this will be done by the CPU, but will the CRS even support this and would there be any deal-breaking limitations?

The only use for the tunnel is to allow us to SSH into a directly connected device, enter 3 or 4 lines of configuration, and then remotely reboot the device, something even an incredibly low bandwidth IPSEC tunnel should be suitable for?

No problem, but do not make more than 10M of traffic or CPU go 100%....