We have a new Draytek 3910 router on a 1Gbps leased line in front of an RDS farm. Normally we whitelist each remote office IP and allow access to the RDS gateway website (RDWEB) however when working from home we require VPN + RDP so we don't publicly expose the RDS Gateway.

We have around 200 VPN users connecting into the router using LT2P over IPSEC and then RDP into the RDS servers. As the number of users gets over 150+ the performance of the Remote desktop session drops and a noticeable lag occurs. If we Remote Desktop via NAT (not VPN) as a test then the servers are really quick so it must be related to the VPN tunnels.

Is this performance drop expected? I know the router supports 500 VPN tunnels so we thought it would be able to handle 200 users easily. Is there a better VPN to try for performance? Any settings we should look at changing?

I guess you'd need some more metrics of actual performance. Can you run some sort of throughput test across the VPN when things are working well, and then when they're slower to get an idea of what's going on. That might also show if it related to RDP specifically. Also run ping tests to see if there is packet loss.