With regard to VPN, you'll need to find the performance rating for the encryption algorithm you plan to use on the crypto engine you plan to use. (The newer ISRs usually have hardware crypto engine, but some router's performance can be further upgraded with additional crypto hardware.)
With regard to other services, performance impact varies, but assuming you remain with fast path processing, I would suggest to allow for up to about a 20% hit.
If your looking at the something like "Portable Product Sheet - Route Pref", also allow for duplex traffic (i.e. half the value). You can also often get 2x the performance of the @64 byte rating for "normal" sized traffic, but since you don't really want the box to hit 100%, you might half the rating for practical limits. (I.e. these two cancel each other.) Or use about 25% of the raw rating for a "within the ball park" rating.
You can also hunt for Cisco recommendation, such as Table 1 in: http://www.cisco.com/en/US/prod/collateral/routers/ps5854/prod_qas0900aecd80169bd6.html. These often allow sufficient performance for about every possible service to be active.
