The RSA keys only need to generate two random primes of the appropriate size, so they can be generated fairly quickly. The DH moduli you generate will contain _many_ primes, and these are [strong primes](https://en.wikipedia.org/wiki/Strong_prime), so they take longer to find. In addition, a 4096-bit DH modulus requires finding a 4096-bit strong prime, whereas a 4096-bit RSA modulus requires finding two 2048-bit primes, which is much faster. This is why generating DH moduli takes so much longer. For both the RSA key and the DH moduli, you want to select 4096 bits. The `-a` option determines the number of KDF rounds used for decrypting your private key on your client with a passphrase. You want to make this as large as possible while not taking so long that it is annoying. All this does is slow down a potential brute force attack against your private key.