Do you have some kind of evidence to back up the claim that the RB4011, RB5009, etc will do the job?
The RB5009 maxes out a 1GB uplink with PPPoE with 10-30% CPU load on all 4 cores in my personal experience.
I has a 4x 1.4GHz 64bit Arm Cortex-A72 CPU compared to 2x 800MHz ARMv7 32bit wich is a lot more CPU power.
At the other hand, the CRS309-1G-8S+ has a much better switch chip.
If you need a capable and fast 10GB switch and not more than 500GB/s routing speed, go for a CRS.
For routing with 3-6GB/s (SFP+) and fast IPSec and a relatively poor 1GB switch chip, go for RB4011.
For routing with 4-7GB/s (SFP+) with less demands on IPsec but want to have a better switch chip, go for the RB5009.
For high speed routing with 10+ GB/s and fast IPsec with mid-class switching, go for a CCR.
One of the challenges is that RB4011/RB5009 are almost impossible to buy. They are out of stock everywhere.