PrivateLink vs inspected TGW
One live stream, two paths — clock PrivateLink against a TGW inspection hairpin, then keep the path that wins on latency and cost.
Reuse your shared inspection hub, add a thin harness (relay, NLB/endpoint service, subscriber), and measure the same Wikimedia SSE stream over PrivateLink versus Transit Gateway through Network Firewall.