What options can throttle connections?

I have a bit of an odd setup, but it is working thus far.

I have fiber -> GbE service from USInternet in Minneapolis

That goes into my 28-port GbE managed switch.

That is VLAN'd for safety and feeds my SuperMicro ESXi box (not the FiberVLAN) and my SuperMicro 1U firewall (FiberVLAN) which then feeds back into the switch for servicing the ESXi and LAN.

I get speed tests from Windows 7 through the default/global VLAN of 600x300 (below rated but not the worry right now) from my management PC - this is my benchmark test location.

I have a pfSense VM running that is routing through the real pfSense server and is getting the rated speed through the firewall on the VLAN. When I isolate a PC VM to the VLAN601/602 networks it gets speeds similar to that of the Management PC (different computer).

For radios I have just installed Ubiquiti UniFi AC LITEs (just installed). They are the ones giving between 30mbps and 60mbps rated performance. This is well below 50% of their link speed (1000mbps), and about 10% of the confirmed throughput speed from both the isolated VM.

Items of note:

• They are linked to the switch at 1000mbps
• There is no listed throttling on them
• TrendNET 653APs I had before (100mbps links) were similarly underperforming HOWEVER I attributed that to 300mbps wireless over 100mbps wired connections.

I'm a little lost on where I might have a hangup. I have to go the double-firewall route for sanity purposes.

If I was having issues solely in the second firewall then I might have an idea as to what is going on but instead I'm flabbergasted. I'd like to tell the customer that it's OK to start pushing customers over to the new network but without this piece working at the speed I am attempting to provide it's proving difficult.

Thoughts?

Edit: Also I have to be on site to test the speed. I live 100 miles away - I can ask the owner to test once, maybe twice, but I should be here to test them myself. So... that means I won't get this going for another month (which is pushing my contractual agreement to get them online, I'm afraid. But that's my problem.)