Well….I'm at a loss.
I'm now testing from hosts behind pfSense (vs between pfSense boxes themselves).
I thought I had a breakthrough when I found aes-ni disabled in Advanced but realized that was a troubleshooting tip here :)
MTU is back to defaults, no MSS clamping, using IKE2....
Both boxes also have OpenVPN tunnels to other boxes but the average load is like 1mbs.
Without the tunnel, I easily get 230-250mbs. With the tunnel (and new since my original post gig wan line) I get 30-50mbs. Xeon on one side* and SH-4860 on the other. Neither CPU spikes above 30-40%.
I tried recreating the P1 and P2 tunnels - no change.
I failed to mention... the Xeon is pfSense running as a VM on Proxmox 5. It's the only VM, the CPU type is host, it has 16gb of ram allocated and direct disk access. So it's basically as close to the bare metal as it can be. But if anyone has any tips related to Prox and aes performance, lay em on me!