If you look at the specs of the pfSense hardware, you will find that they include 10Gbps NICs starting with an Atom C3558 and a Xeon D-1541 is where they top out. One thing to look at on the chart is the iPerf3 and IMIX performance limitations for each solution.
My thought would be to pick a cpu that at least equals the D-1541 on individual core performance and total performance. You’re probably going to want to look in the E5-2630 and E5-2640 ranges for v3 and v4 generations. In my mind, the lower core count, higher clock models will give you the best performance. However, they are also the most expensive. The E5-6243 v4 is $525+ used. Whereas the E5-2630 v3 is around $40.
4 GB of memory is antiquate, and I think that anything over 8 GB would be overkill. If you find that you need more for some reason, you’ll have plenty of slots to add another stick or two.
Hope that helps.