The first two would be closer to ideal. The Buffalo is Broadcom. There are other Broadcom devices that aren't horribly bad, but the problem is lack of updated wifi driver support for Broadcom. Broadcom are still good devices, but Atheros is where it is at. The R7800 and EA8500 Linksys as well as the Archer C7 V5 are among the flagship or upper end devices supported by this firmware. Less expensive devices may not perform well for VPN, or include VPN functionality in the firmware.
I have located a EA8500 Linksys locally and should pick it up this weekend.
I dearly hope that this router support openvpn and that it's as easy to flash as was my old D-Link DIR-615.
Thanks again for pointing me in the right direction.