@maverickws

have you checked iperf3 speeds between pfsense and xcp-ng itself?
Mine is bad. Additionally from pfsense to xcp-ng it has many retries during transfer

That should not apply in this situation as 172.16.0.1 is the internal IP of the outer firewall so, presumably, does not have a gateway and hence also wouldn't have those rules.
It doesn't apply to the inner firewall as that is outbound traffic from a device on the 192.168.9.X subnet which is always allowed.

I assume you are NATing the outbound traffic in the inner firewall, the default configuration?

I would run a packet capture first on the WAN interface of the inner firewall. Filter by host IP 172.16.0.1 and try to access the outer firewall from a client on the 192.168.9.X subnet.

If you see traffic there try the same thing on the outer firewall LAN interface.

Either the outer firewall is blocking that traffic deliberately or it has some touting problem that means it cannot reply. For example perhaps that traffic is not being NAT'd for some reason so it has no route back to 192.168.9.X. The packet cap should show what's happening.

Steve