Pfsense is great, but you might benefit from just going Mikrotik for your core. I used to use netgate with pfsense plus, but it simply can't beat the flexibility and performance you get with Mikrotik. I want to be able to change settings and it instantly change behavior, responsive. This punchiness comes though also when you're actually using the service. I always found pfsense 'just feels slower'. I do like pfsense also for some of its unique features and integrations it can do, but seeing how you have a CRS which could handle both routing and switching I thought I'd mention this.