Yes, it’s normal because you have tunneling and encryption performance hits.
Tunneling traffic eats may be 10% or more – don’t know, and encryption may reduce traffic by 20-60% according to selected encryption protocol.
There are not only packets payload but additional work for CPU and/or NIC. You can try this by copying file over, for example, ftp protocol, and then over ssh (scp).