I’ve checked the differences between the vyos 1.2.5 and 1.3. The latter has some options off by default, such as tcp-segmentation-offload, generic-segmentation-offload, generic-receive-offload. I’ve enabled all of them with:
ethtool -K ethX sg on
ethtool -K ethX gso on
ethtool -K ethX gro on
Iperf3 tests now show 20 Gbits/s between routed VMs.