A Home Networking Solution (including firewall/VPN)

I'm looking at this architecture:

50MB ADSL Service: Arris BGW210-700 (bridge mode, no wifi, no DHCP, no DNS

Adding Firewall/VPN Netgate SG-1100 (running Pfsense) - plug into DSL Router - running PIA VPN

Adding TP-Link AC1750 wireless router - Running AC1750 native - plug into Netgate Firewall/VPN

also considered Pi-hole ad-blocking sinkhole

connecting up to 20 devices via wireless to TP-Link

​

Any ideas, suggestions, recommendations or improvements, or optimizations for this configuration?

Does anyone have any comments about recursive dns in this environment? Worth the trouble?