Hi DanMan,
The first thing that I notice is that the mikrotik router is on the lan side. Normally the routers are on the wan side. If the Mikrotik routers are creating a tunnel between each other then the topology might need a change so that they are on the wan side. This is because if there is a tunnel on the lan side, there is a good chance that Wanos will pass the traffic through or not be able to do much if its encrypted. That said we have similar satellite ISP setups and tunneling has not been required.
1) 5 Mbps is not much and you should be fine with min 2 CPU threads and standard HDD. 4 CPU threads are recommended and will provide an improvement, but basically nothing beyond 4 threads (due to the ptp link).
2) In the scenario with the Mikrotik on the lan, then yes, PLR would only be applied on the optimized packets processed by Wanos. If lots of drops are expected then having the Mikrotik on the lan is good (assuming no tunnel).
3) The ATOM D525/D2550 processor can handle upstream 10 Mbps with all features enabled, but it is not ideal. A higher spec CPU is recommended.
Yes, Express is limited to 6 Mbps of optimized traffic upstream. To stay below 6 Mbps of optimized traffic rate limit, a bypass rule can be created to pass-through some traffic. Pass-through traffic is not counted.