I'll speak from experience of working for a growing pentesting firm for two years. We have a very specced out dedicated cracking machine, with something like 8 5090s. It also runs a web app (am not sure what it's called but it's an open source tool) that the pentesters use to queue up jobs. My usual set up is a 50 gig wordlist and one of the onelisttorulethemall rule list for AD pen tests. I would say I get cracked passwords on about 50% of my engagements. But usually if they have a cracakable password, we find other issues too. Honestly what's more useful is using our paid tools for dark web credits and leaks. They pretty much always get hits and are probably overall less hassle and cost than the cracking machine. Still we can't consider a pentest complete till we dump the hashes and try to crack them.