I would suggest neither. Buy another RT-AX58U for the best experience.
If you won't need the fastest speed possible over a VPN in the foreseeable future (then it would be either an RT-AC86U or RT-AX88U as your main router for the AES-NI performance increase they offer VPN connections (from about 40Mbps on the RT-AX58U up to 250Mbps on the suggested models, depending on both ends of the ISP's up/down speeds/capabilities).