I may be mistaken (wouldn't be the first time - laugh) but my understanding of bandwidth throughput caps, on the ISR 4Ks, is based on the bandwidth as it transits the router. I.e. you should only need to sum up all interfaces' ingress bandwidth. (NB: this because, one interface's "in" bandwidth, excluding drops, becomes other interfaces' "out" bandwidth, as it's only processed once, not twice, by the CPU for forwarding. [This is also why, on some device stats, a device's PPS rate's bandwidth is half its "fabric/backplane" bandwidth - for the latter, all interfaces "in" and "out" bandwidth is summed - much like a "duplex" link "counts" the two way bandwidth.])
So, for example, if you have a WAN with 500 Mbps up and down bandwidth, and it's LAN interface(s) were NOT processing any other traffic (e.g. LAN-to-LAN), you would need a performance capacity of 1 Gbps (as the WAN interface could provide 500 Mbps "in", and the LAN interface[s] could provide 500 Mbps, also "in" [directed to the WAN interface's "out"].)
Also BTW, when it comes to and ISR's basic throughtput cap, its "performance" cap and its "boost" cap, the first two are usually "guaranteed", as the router has sufficient reserve capacity to meet those limits regardless of traffic mix and/or router configuration. (NB: encryption is often an exception, but that's encryption hosted on the router. Pass-thru shouldn't be any more demanding than any other traffic.) However, the "boost" caps, removes the logical cap and hence the router works much like earlier ISR generations, i.e. throughput can vary much based on traffic mix and/or configuration.
