I know this is an old thread, but while doing my own research, this was the closest thing to a technical conversation on Circle. For the archives, I thought I'd add more information since I've done in depth testing now.
I have been looking for a solution to better controls and my wireless solution was getting old and slow. I did extensive testing between the Linksys Velop and the NetGear Orbi. I primarily wanted Orbi to win because it has Circle built in. Unfortunately it really suffers from degraded wifi speeds. At some point I'll probably post my detailed results on this comparison online.
While doing a several week test period on the Orbi, the Circle functionality was an obvious keeper from my POV in terms of managing my son.
Knowing that the standalone Circle device works with Arp Poisoning, I was concerned about the network performance impact and any other weirdness I might see on all the non-kid devices. Conceptually I really preferred the control built into the router as opposed to bouncing traffic off to a second device. I seriously considered getting another, cheaper Netgear router to run Circle on since at best they cost ~$40 more than the standalone Circle device. That price would be worth it to avoid unknown arp / traffic redirection issues. However with the NetGear integration, you have to pay $4.99 a month for the "premium" features that are included with the standalone device purchase...and without those features, the Circle stuff isn't much better than very basic controls included with any router imo. That was enough for me to go buy a Circle device locally to see how it really worked in practice.
The support page at Circle gives a very high level of Arp poisoning but doesn't talk anywhere about when and how this really works in practice... Probably to avoid savy kids from working around it but really for in the weeds techies like me, this can be a turn off.
I looked closely at the traffic using WireShark to understand what's really happening with Circle. I was pleasantly surprised.
In Circle you have a few categories of devices: Unmanaged / Managed. Then in Managed you have different levels. One of those levels is "none". What I discovered is that the Arp poisoning is device and level specific.
The traffic is NOT redirected for Unmanaged devices ever. They talk directly to the router's mac address. Additionally, devices that are managed but set to the "none" level also normally are not redirected. The difference between these two settings is that Managed/None can still be paused either by category or when you "pause" internet for the whole house. When you do this, Circle sends out a ton of Arp traffic to redirect all those devices to it so that the internet is blocked. This takes effect within a few seconds. When you unpause the internet, within a few seconds, the Arp poisoning is undone, and "none" level devices resume talking directly to the router.
Of course, filtered devices are always being redirected to Circle.
So in summary:
unmanaged: traffic is never directed to Circle.
managed / none: traffic is only directed to Circle when the profile or home is paused. When unpaused, the traffic goes back to the router within a few seconds.
managed / all other profiles: traffic is always directed through Circle.
Now, how about performance of the redirected traffic? Shockingly, even on Wifi (with the LinkSys Velop) the impact was less than 1mbps where my internet tops out at 120mbps with no Circle. I saw similar impact using the ethernet cable, but note that this is 100mbps only not GigE so in theory the Wifi should be faster if your Wifi AC AP can handle it efficiently.
For my purposes, even a <1% hit across the board for internet access would be acceptable for the improved visibility and control. Even better is that I can be sure that Circle doesn't interfere with any device I don't want it to... at all.