Ok. And we have something chewing CPU. The EoIP is a GRE tunnel. It creates a new interface at each point.
This means that the traffic inside the EoIP will cross the firewall, using the forward chain. It is as if your router had grown an extra ethernet port, and what come out of it will follow normal rules.
I refer You, one more time, to this flowchart:
https://wiki.mikrotik.com/wiki/Manual:P ... outerOS_v6
It is the one named "Changes in RouterOS v6". A packet, from one windows machine, would follow this way (I considered it not bridged, but bridged would be the same, where we are concerned).
windows machine 1 -> ethernet on hEX3 -> Input Interface (not bridged) -> pre routing -> Routing Decision -> Input -> Ipse Policy? (Yes) -> IPSec Decryption -> Prerouting (again!) -> Routing Decision -> Forward (it goes to the other windows machine) -> out intercface (not bridged) -> Postrouting -> IPSec Policy (no) -> Interface queue tree -> output interface -> windows machine 2
I don't know why that one forward rule of yours hadn't the counter incremented. Maybe there is something there that will not match this traffic. As you don't have a default deny, everything would pass anyway.
Even if I am wrong, and the internal EoIP traffic doesn't use the forward chain, You still have some problem with the network part - not the IPSec part. That 2 cores at 100% are not normal, with just 250 - 300 Mbps.