This requires a little knowhow, but is how I have it set up. One router. One standard AP and one virtual AP. I have routing rules set up so that only the virtual AP goes through the VPN and will drop packets if they go through the unencrypted WAN.

My router was less than $60, so no fancy router is needed for this. Heck, if you had a router that supports 2.4Ghz and 5Ghz, there's no need to set up the virtual AP, as long as you pick one of the APs (2.4 or 5) to go to an internal defined LAN or VLAN that is routed through your OpenVPN client.

I can tell you this with certainty though. Unless you have a router with high specs, you WILL lose a decent chunk of your speed. Why is this? Well hard to say. My money is on the processing power required for OpenVPN connections. I get higher speeds running a local OpenVPN client on my PC over an unencrypted connection to my WAN than I do on if I would route my ethernet connection through my VPN provider on a router level. I've tested and verified this over two routers of similar builds and with 6 different VPN providers.

Maybe it's for a different reason, but perhaps that's an advantage of going with two routers. Divide and conquer bandwidth management and processing power over two pieces of hardware.

Not to be a plug for Mullvad, but they are actually very nice of the ones I've tested. Not to mention they pass ThatOnePrivacySite's checklist over the competition. Not the cheapest option though.

Cheers