I really like the Odroid H2's...
https://ameridroid.com/products/odroid-h2
On backorder atm - but I have 3 currently tricked out with 16G RAM and 2x200G SATA SSD. Total cost was less then $250/unit.
The ProtectLi boxes might cost a little bit more, but they seem to be really well made and of good quality. I moved from a PCEngines APU to a ProtectLi because I needed faster packet forwarding performance when I upgraded my home internet connection to 1 Gbps.
I run an apu2c4 at home, with 1 Gbps internet connectivity. It’s a two legged setup, one leg to the ONT, and one leg to the switch carrying dot1q tagged VLAN traffic. It never fails to saturate that internal interface and does that with ~20-30% cpu idle time. I also run few small processes like DNS, NTP, syslog receiver in their own containers, serving the home. The only time this machine struggles is when my wife is out in a library, coffee shop with good connectivity and her VPN traffic (wireguard) to home is above 200 Mbps and at the same time I’m downloading from somewhere that can feed me at least 800Mbps. In this case it cannot saturate the gigabit interface because CPU is too busy.
Linux 4.19 kernel. IPtables for packet filtering and IPv4 NAT. ~30% of my traffic is v6 without NAT overhead.
OPNSense 20+ also support WireGuard just in case someone gets confused about that specific version reference.