If you're in a 1U chassis, all sorts of options are open to you.
Without giving specific recommendations, I can list what I'd prioritize. I'm not going to go for embedded solution answers due to your 1U preference, though the pfsense store does have 1U appliances that will likely crush your workload.
1. High clock speed, and at least four cores (not 2 cores with SMT). OpenVPN tunnels are currently single threaded. You have three, as do I, so each can use a single logical core, but the raw speed of that core will ultimately determine the throughput of each tunnel.
2. AES-NI will help now. QuickAssist for the future.
3. Ultimate future-proofing would be a socketed (and therefore likely NOT fanless) motherboard, but having a 1U chassis where you can swap the board without replacing the entire system second best.
4. Upgradeable RAM. 4GB is probably fine for your use case. But for the future… ECC if you're especially concerned with uptime. Likely you'll be upgrading and therefore rebooting far more often than is warranted by ECC.
5. A combination of embedded Intel NICs and a PCI-e x4 slot to add more (or to use your older NIC with the em driver).
As for your storage questions, I'll leave those for others to answer. I'd love to see pfsense run from rpool with the ability to add a mirror.