I personally use a J3455 based Celeron box with PFSense and my network couldn't be happier.
If you want to use encrypted services like VPN's with good throughput you want a CPU with AES-NI, encrypt/decrypt instruction set.
PFSense is FreeBSD based and has a solid network stack for these kind of tasks. I have my entire network ran through a VPN, firewalled everything but what I access, and have ad-blocking for most sites. Plus, not too hard to set up rules, like PS4 to bypass anonymous VPN.
I love ARM based systems but if you need more than basic, or looking to support lots of devices, I recommend at least a CPu with AES-NI no matter which OS you go with.