RB750GRE
They should all be able to run a VPN, its just the speed you’ll get through it that will vary. That particular model is pretty old now I would not get that unless your budget is limited. The refreshed version of that is the E50UG, which is a lot more powerful, but its still a budget device. I have no idea when openwrt will be coming for the refreshed hex, but it should not be that long as other arm devices from mikrotik are supported.
It requires a bit of work to setup routeros but the guides for the common tasks are easy enough to follow. Its only if you want to do something outside of the guides or miss a step that it becomes a PITA if you aren’t familiar with networking.
Mikrotik wont need openwrt unless you are dead set on having an open source OS on your device.
Mikrotik supports all sorts of VPN connections, both client, server, and site to site. You could even get creative and have it for certain services or IP addresses.
If you get one of the more modern devices it will support a pretty chunky VPN as well, mine can get over 600mbps without much hassle.
Yeah making it optional for them to turn on because they are still entitled to privacy even though they are children is the key to building trust. Them trusting you as a parent is the most essential thing here, there is always a way around something, you want them being honest by choice rather than sneaky or you forcing “honesty” by coercion.
We always did that from when the kids were younger and my now adult daughter still chooses to turn it on when going on dates.