I don't think that the Archer C7 hardware (or most consumer router hardware) supports any kind of encryption acceleration aside from what's built in to the WiFi radios. If you want a hardware accelerated VPN, you need to either get one of the Cavium-based Ubiquiti routers or something with a relatively high-end processor implementing AES instructions.
The lower routing performance has largely been solved in 18.06 with software flow offloading.
> I tried using both open (no auth) and WPA/WPA2
meaning even without encryption, the TCP performance with OpenWRT was worse than the original firmware.