

+1 for Mikrotik.
Get one of their routers that have an Arm or x86 processor and you can run PiHole and a DDNS updater on there as containers. Wireguard support (client and server) is built in.
Even their cheapest hardware that runs routerOS has access to all the same features as their enterprise level gear.
This has been the agreed-upon way to do things within the MS umbrella for a while. Not sure why they won’t just allow for setting a higher rate limit.
Each app registration in a tenant gets their own limits. Most backup platforms for an MS tenant have you register 4-10 apps so it can parallelize the backup load without getting rate limited.