The speed could be limited in multiple ways by including one/some bottleneck(s):
- WiFi itself being limited
- The Pi's internet connection is slow, or...
- limited via interface bandwidth..
- or the Pi encrypting/decrypting data
- Servers being biased towards VPN'd traffic (if it is obviously a VPN, semi-common with Commerical VPNs). Some will straight up try and block them as they can me used to get around geo-blocking (like to use BBC services outside the UK)
As for security, IF properly configured (on the Pi and the device) the VPN connects your device to the Pi through an encrypted connection (after that it will continue relatively normally), so it should be great at reducing the risk of your data being nicked (or modified) from insecure WiFi networks.
Some worries include DNS leaking, which can be tested for and mitigated, and data can still be associated with the IP address of the Pi (as well as device/browser data) so some tracking can still occur (from ad networks etc).
If you can test the connection with and without the VPN where the Pi is as well as elsewhere (say by googling speed test, and providing the output for ping 8.8.4.4 as an example). and perhaps how it was configured roughly (e.g. is the Pi relaying data from ethernet to WiFi, settings etc), I could make this answer more specific!