I build custom PfSense units; if you have some old mini-PCs that can have a second NIC added to them via PCIe this can be setup very easily. Unlike the Cisco / other route, these will always get updates without a support contract and can almost always update to the next major software release without hardware deprecation.
If you scrounge some machines I can guide you through the setup or, provide a couple beers, can meet you at the makerspace.
Alternatively OpenWRT works well as well; both setups would be using OpenVPN or IPSec regardless. However, with the PfSense route you could setup Multi-WAN easier with a multiport NIC, whereas on many routers you could flash OpenWRT to the switch may or may not be bonded as a switch on the chipset rather than logically, preventing port separation.
The official hardware from Netgate, should you want a prebuilt, is super-nice and well tested. You can also find various third party builds on Amazon. I found some of the best machines to use for small offices are Car Computers (since they’re compact, often fanless, and still general x86)