To conclude on this investigation, I would suggest that the Raspberry Pi 4 should be fine for WAN link speeds up to about 100Mbs or so, but above that, the cpu cores are too slow to process the statefull inspection. Perhaps tweaking the NIC interrupt cpu affinity could help somewhat, but the best I found was a doubling of throughput.
Due to this, possibly one might as well use a standard Pi 4 with a USB attached second NIC. This would avoid the installation complications required if using the compute module. I haven’t tried this, so cannot comment on the reliability of a USB NIC dongle. I can say that the DFRobot board has been working very reliably.
However, further thought led me to conclude that a better way of avoiding the manual replugging of the compute module between the I/O board and the DFRobot board would be to use a standard Pi 4 to install and configure IpFire onto an sd card, configure the GREEN interface, enable SSH, then move the sd card to a compute module lite / DFRobot combination and reconfigure the RED interface via SSH. This would necessitate the purchase of a second Pi 4 board, but would avoid the need to purchase the compute module I/O board (which costs a similar amount). The CM4/DFRobot + case set up is very nice.
One additional thing: I forgot to add that I also updated the EEPROM before installing. This is discussed here: Need to full support Raspberrypi 4B! - #4 by arne_f