I have two physical sites each with edge router/firewall running pfSense they are directly connected through a WAN link. I've deployed site-to-site OpenVPN using pre-shared key to create tunnel on top of this WAN. I'm using this connection only to connect my core infrastructure of the organization (DFS, Root DC replication, NTP sync). One of my pfSenses is also a host-to-Site OpenVPN server used by my admins & devs to make remote connections to the infrastructure. My only ports open on the public facing WAN's are 443 for my web-servers and 1194 for my host to site (cert + radius authentication), i have also some narrow rules for NTP and exchange.
Given that my routers are directly connected should I be really concern about possibility of somebody sniffing traffic on this WAN and reversing the keys? Is there a way to capture the traffic going between those routers without compromising them? If my traffic is already encrypted before entering the tunnel may it be considered secure, or should I work towards something even more secure like OpenVPN with the certs?