Haha Asus is a pet hate of mine (and some of the other posters here). Their consumer routers are woeful, and suffer from laggy to non-existent security updates. They (Asus) are under sanction and mandatory supervision and auditing by the US authorities for exactly that - shipping inadequate and dangerous products that left users at risk and under attack. If you're going to put your own router in front of a modem, it's much better to buy a proper router (not an underpowered consumer all-in-one box), with standalone WiFi access point(s) as required.
Alas, if you're managing to hit 900Mbps sometimes we're not that much further on (yet). That rules out config issues with VM but not line issues (eg power levels), network adapter or cable issues, driver issues and so on. Usually the answer is rather simple in the end - a dodgy cable, network drivers, out of spec power levels on the hub or similar. If you try with the SH in router mode directly, then a different cable and network adapter (if possible) and under a Linux or FreeBSD live USB, you rule out various possibilities as you go (drivers, adapter, OS/AV/bottlenecking).
Just to check, also, when you say Ookla speedtest do you mean the standalone app or through the browser? Browsers are rubbish at doing gigabit, they want low latency and don't really care about total throughput so much. If you aren't already testing in the standalone app (Windows store, CLI app from speedtest.net site etc) then please do so first.