Yes, to terminate VPN (inc. GRE over IPSec) on 7604, you would need to have the SPA-IPSEC module as the IOS is not capable of terminating VPN except if you configure VPN Client to manage the 7604 itself. Other than that, if you would like to pass traffic through and terminate VPN on the 7604, then you would need the SPA module.
Hope that answers your question.