How to find the weakest link in my setup?

I have a setup where the OpenWrt router is connected to a modem through WAN. The routers role is to enable WiFi, create a VNET, encrypt the outgoing traffic using Wireguard VPN and hand it over to WAN.

From time to time I can see that the internet speeds drop significantly. How can I find out what is causing the problem?
I am guessing a few options:

  • The ISP connection is slow/modem is slow
  • The VPN provider is slow
  • The router encryption process is slow
  • The WiFi link is slow

How can I find out which one exactly is the weakest link here? The most likely options are either the ISP or the VPN provider. If I know which one is that, then I can switch to different providers.

run speedtest or similar services from your LAN, preferably from a wired device.
it's not 100% reliable though.

disable VPN, compare the speed.

run htop in cli, check the CPU load.

compare with a wired connection,
find out the max speed running a iperf2 test between a wired, and a wireless device.