I have a similar setup minus the non ISP modem, is your setup have an additional security or privacy benift or is just more like redundancy? I ask because I thought Opnsense would just take care of ISP from monitoring what devices are on your network and a VPN will encrypt the data packets from them inspecting them.