I can't comment on MCUs or WiFi BSSIDs, but on the server side I have an Intel Atom N2800 (think low performance) with nearly 4000 clients sending out ~50k messages/s with an average payload size of 80 bytes. The overwhelming majority of those are not using TLS. About a quarter using MQTT over websockets.