I always recommend offloading the IPsec from the routers or at a minimum use the available encryption modules. It’s very taxing on a router to process these tunnels so a stand-alone device is definitely a better alternative. The concentrators are excellent, fast & reliable. If the remote sites are small enough or there are budget considerations, you can start with terminating the remote site routers to the concentrator at headquarters.