Help with replacement model

My office has an HA pair of 600E’s with a WAN link of 1.5Gbps and failover link of 1Gbps. We have 10Gb connections from the gates to the core switches.

We have about 1,000-1,200 devices (including user personal devices) onsite and have 10-20 users connected via IPsec dialup and one S2S to AWS. IPsec tunnels using AES256 (CBC) currently and would like to switch to GCM once we get a unit that supports offloading it https://speedtest.vet/ .

We use an average of 39% memory and the CPU rarely goes above 10%.

I am trying to right-size our environment. I am looking at 400F’s and 200G’s to replace the 6 year old 600E’s.

I’m hoping to get input on either the 400F or 200G (unless there are other models others would recommend). Hoping to get us cheaper units that aren’t overkill without reducing performance.

Thanks