[Wubdidu]

Probably depends on how complex your setup will be. We are running a normal 1GB Pi4 with OpenWRT (trunk until now) for quite a while on a 1gbit down/500mbit up fibre uplink with SQM against bufferbloat. Unifi switches handle all VLAN related work, fibre uplink is on VLAN 7 mandated by the carrier, so PPPoE works with only one LAN port on the Pi4. Wifi is also unifi hardware.

Thanks to full duplex, clients are able to use the fibre uplink without slowdown. VPN is managed by a separate system, though we had some successful experiments with WireGuard. Both a colleague and I are running the exact same setup at home (with fibre uplink and VDSL).

It's a very capable and power efficient setup. I'd definitely go with a CM4+dual NIC board today.