You budget seems realistic for "gigabit speeds" with more than just NAT in play.
My recent testing indicates that even a desktop-class x86_64 with AES-NI can't handle more than ~500 Mbps for OpenVPN. It will, however handle the ~900 Mbps throughput limit of WireGuard over GigE. This is without SQM. I have not yet examined SQM performance alone, or in conjunction with a VPN.
I don't know about the CPU performance of the IPQ806x as I don't own one of those either. My gut feeling is that it isn't up to passing a gigabit (or two, if symmetric) through the main CPU. While I have read that it has network-acceleration cores, I don't know the status of their drivers. See further IPQ806x NSS Drivers
For recent discussion of gigabit-speed processing, see the linked post and following
Correct, ipq806x isn't up to routing/ NAT beyond ~400-450 MBit/s (without SQM; you might hit up to ~650 MBit/s in synthetic benchmarking, but not in practice) without the help of its NSS/ NPU cores - which aren't available for OpenWrt, yet (and may never be).