Did you see the performance hit from enabling TLS 1.3 inspection?

Hey folks, I've been piloting a pair of Sophos XGS appliances (2100 series) in our AWS transit gateway setup for about six months. We recently enabled TLS 1.3 deep inspection to meet some new compliance requirements, and I've been digging into the performance metrics.

I observed a noticeable increase in latency for TLS 1.3 connections, particularly on services with many short-lived connections (like microservices APIs). The CPU load on the boxes also jumped more than I expected. Our baseline was roughly 40% utilization on average, and post-enablement we're seeing sustained 65-70% under similar traffic patterns.

Here's a quick breakdown of our config and the traffic profile:
* **Inspection Profile:** Enabled TLS 1.3 with DPI, using a custom CA deployed to all endpoints.
* **Traffic Mix:** ~60% HTTPS (TLS 1.2/1.3), 30% internal protocols, 10% other.
* **Rule Set:** We apply inspection policies based on user groups and destination tags.

Has anyone else done a similar rollout? I'm particularly curious about:
- Whether you saw a similar latency/CPU impact and if you found tuning parameters to mitigate it.
- Any differences you observed between inspecting TLS 1.2 vs. TLS 1.3 traffic.
- If you decided to exclude certain high-performance or internal services from inspection, and how you structured those policies.

I'm planning to do a more formal cost/performance analysis (this will affect our instance sizing forecasts), so any real-world data or config snippets would be super helpful.

-- Amy