The NIC is an Intel x520. pfSense/opnSense both maxed out at routing about 5-7 Gbps with about 20% CPU usage (I'm assuming one core maxed) with the default config (so no IPS or QoS or anything configured, just basic NAT)

Tried a bunch of the random tunables people were posting on forums, tried turning on the hardware offload the manual says you shouldn't touch, it made no difference.