You are correct, behind the curtain is Suricata.
This is good to hear, because the appliance I have pfsense on is a PCEngine APU 2 which can handle the traffic just fine.
Now I just need to learn how to configure pfSense to act only as a Suricata device and then pass on to the USG. You wouldn't...