The R6S is overkill and in any case not supported by OpenWrt. I would stick with the R4S. The R4S has more than enough CPU to seamlessly handle OpenVPN on your 100 Mbs connection (it will easily handle OpenVPN at even twice that throughput). The CPU in the Archer C7 is just too slow to run OpenVPN.
You are using un-managed switches in your design. Could you segregate your networks with VLANs (using the R4S to manage the VLANs and run OpenVPN) and use managed switches instead? Perhaps add a single R4S, and then "buy" your first managed switch for free (you already have it) by configuring your Archer C7 as a managed switch (and dumb AP)?
One of the VLANs configured on the R4S could be reserved for the corporate laptop, and you can configure other VLANs on the R4S for home, Guest, IOT, etc. networks. On your WiFi AP's you can configure SSID's dedicated to each VLAN - assuming the AP's are VLAN capable, which yours are if you are running OpenWrt on them. If your corporate laptop connects to a wired Ethernet port, you can similarly dedicate a managed switch port to the corporate VLAN.
For the corporate OpenVPN link, there are ways to use policy based routing to run all traffic on the corporate VLAN through an OpenVPN client on your R4S. Check out this thread.