Most flexible is a bespoke make-it-yourself pfSense install I would say. Other opensource firewall/router distributions are also available that may be as good but I don't know.
A netgate pfSense appliance will work well naturally
Asus AC86U I believe can manage a significant speed and is probably the best compromise between being consumer orientated and having the performance.
Mikrotik do a router I keep forgetting the name of that people say can push some speed through VPN at a low price but has a very steep learning curve.
Things that have Open-WRT and Tomato or other custom firmware can run a VPN client but are often underpowered to make full use of your internet connection.
I assume, but don't know for sure, that Ubiquiti products can do it as well as lots of expensive enterprise kit.
Rather than replace your router you can put something like a Pi on your network, connect that to a VPN and selectively route some or all of your LAN traffic via it to be hidden.
When making your choice consider if you need to max out your internet connection or not and whether you you really want your entire network behind a VPN. Geo-sensitive streaming services can be problematic as for everyone you bypass you find that iPlayer stops working on your smart TV. I think those two things, together with how much networking knowledge you have, are the deciding factors on what is best for you.
Personally I bought a six-NIC fanless mini PC with a CPU supporting AES-NI and put pfSense on it and wouldn't ever go back to anything else but it isn't for everyone and cost about £300 to put together. If you've any old PC parts you could try and do it yourself for modest cost.
can't see that happening now.
