Thanks for the suggestion, hhth. I forgot to include the following information - as you can see, IPSec offload is enabled.
$ show system image The system currently has the following image(s) installed: v1.8.5.4884695.160608.1057 (running image) (default boot) v1.8.5rc1.4882235.160530.2158 $ show ubnt offload IP offload module : loaded IPv4 forwarding: enabled vlan : disabled pppoe : disabled gre : disabled IPv6 forwarding: disabled vlan : disabled pppoe : disabled IPSec offload module: loaded Traffic Analysis : export : enabled dpi : disabled