Hi,

Looking for a single box I can take on the road that will be a WIFI AP for a small number of clients that supports:

Upstream gigE and WIFI support (venues might have either)
Sufficient CPU to terminate a VPN (OpenVPN or wireguard pref) at speeds to allow video conferencing/streaming.

Do not need upstream LTE.

Use case is basically global road warrior who wants to use the AP for my devices (tablet, kindle, phone, laptop, chromecast) where the venue I'm at may have wired or wireless internet available. So just want it to NAT my devices to the upstream and connect to a VPN for my internet traffic.

Is this use case something a hAP ax² or hAP ax³ could do or would I need to look at bigger/different boxes?

Thanks!

AX2 and AX3 are both valid options though personally I think AX3 is not really practical with the BIG ears.
No need to go bigger. Those are pretty decent routing devices.

You can even go smaller resource-wise because AX Lite might also be an option.
AX2 is however physically slightly smaller then AX Lite and allows for vertical or horizontal positioning.
Personally AX2 is a bit more practical for a road warrior (more compact, easier to stow away and not bothered with the angled feet which just adds air / space in your luggage).

If you do consider adding LTE to the mix, AX Lite LTE is also a quite sweet device.

I'd suggest to go with dual-radio device (i.e. 2.4GHz + 5GHz bands).

The reason is requirement for using WiFi as upstream. The problem is that when device uses same radio both in station mode (required to connect to upstream AP) and AP mode (required for wireless devices to connect to it), master interface has to be used in station mode so that it can connect to upstream AP (and follow frequency selection, channel width etc.). However, while device does searching for AP to connect to, it's unable to serve as AP (because radio is changing frequency and other physical parameters all the time in order to find a suitable AP to connect to). If a roadwarrior needs to adjust configuration of device (and it's likely SSID and PSK needs to be set), then it's only possible to do it using wired connection to device.
Further more, if venue offers wired upstream connection, radio has to be reconfigured not to be used in station mode but only in AP mode. Again need for administrative connection which is not possible if radio is searching for AP to connect to.

With dual-radio device this is not a problem because one of radios can then be dedicated to upstream connection (e.g. 2.4GHz radio) and the other one can be exclusively be used in AP mode (which then runs also when upstream connection is not available) and administration is then always possible.

The above is a non-issue if roadwarrior always carries a wired device (laptop) on him and that device is then used to adjust config according to venue requirements.

Both the hAP ax² and hAP ax³ could be good options for your needs. They're compact, support both wired and wireless connections upstream, and have enough processing power for a VPN and basic streaming/conferencing.

Here's a quick breakdown:

hAP ax²: More affordable, good for smaller spaces and fewer devices.
hAP ax³: More powerful CPU, better for multiple devices and heavier use.
Ultimately, the best choice depends on your budget and how many devices you'll be connecting.