Threat Prevention and gateway performance question

[Justin_Sanders]

Hoping someone could explain an observation we have seen with a recent change in traffic patterns. 

Pre covid we have all of our staff on site going through gateways with the following topology

Bond1 - Internal 
Bond2.x - External Internet
Bond3 - Internal (Most employees here)

Running IPS, Anti-malware, and Anti-bot under the above setup results in very little traffic being accelerated. But turning off IPS results in 40+% traffic acceleration and noticeably less CPU consumption. I have always assumed this was because any traffic flow not leaving  bond2 would be accelerated as IPS is off, and Antibot, Anti-Malware are only interested in external traffic. 

After covid the vast majority of employees are working from home and the topology changes to 

Bond1-Internal
Bond2.x - External Internet
Bond2.y - Internal (VPN concentrators)

In this new topology there is 0 traffic being accelerated. Doesnt matter if I turn off IPS. We dont see any performance improvement unless I turn off threat prevention policy entirely.  

So I have two questions. 

1. Is my assumption regarding the performance increase in topology 1 correct?
2. If number 1 is correct, why does it not apply to topology 2? - Traffic between bond1 and bond2.y is all labeled internal, so I would expect that IPS off would yield results similar to the past. But I've also wondered if it has something to do with bond2.y being on the same physical interfaces as bond2.x which is labelled external. 

Any insight appreciated. Thanks. 

[PhoneBoy]

I’m not clear about the remote access users: are they terminating on a device behind the gateway, then traversing the gateway again to reach the internal network?
Also, is that VPN traffic NAT-T (UDP 4500) or IPSec (IP Proto 50)?
Super Seven output, please (and version/JHF level): https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40...