Questions on CRS310-8G-2S-IN performance impact on VLAN routing with WAN routing

Hi there,

I have a couple of questions which I hope will be easy to answer. Currently looking at using a CRS310-8G-2S-IN for a one size fits all solution:

1. Use it to route to my broadband (1.1 Gbps). I've tested internally and it seems to peak at around 1.3 gbps for the current routing/firewall rules I have, which tracks the block diagram so I think it should be ok for now. In the future I'll add a proper router if speeds exceed it.

2. I want to create separate VLANs for wireless ssids coming from tp-link omada wifi 7 APs. I'll have three wireless ssids on three separate VLANs - regular network for trusted devices (e.g. servers, NAS, some personal devices), a guest network for visitors, and an IoT network for all those pesky smart devices. Perhaps one more for streaming devices which I frankly don't trust (e.g. roku, samsung, etc.)

A few questions I'm hoping to hear:

1. I want to use a DNS server running pihole across all Internal and IoT VLANs, but not guest; my understanding is this necessitates L3 VLAN routing. Given the traffic should be trivial (DNS lookups for internal services), should I worry about performance problems?

2. Given the high cpu usage, will saturating the WAN port impact internal LAN traffic (between devices e.g. NAS), if at all?

3. Any other considerations I should think about?

Villain origin story: Longer story short - this comes from the inexplicable and infuring experience I've had wifi 7 consumer routers (e.g. deco) from not allowing separate DNS servers with multiple ssids together with tagging physical interfaces (either as trunks or as singular vlans).

Thanks in advance! As someone in engineering who's always benefited from great network engineers, this process has given me a whole new appreciation of the complexities of this specialty.