Cisco Switching/Routing :: 5510 / 2811 - MPLS Options At Company HQ

I've studied and labeled out MPLS and MPLS VPNs several times.  The situation I'm presented with is a little different from most of the case studies I've seen in my MPLS books.  I've attached a diagram.
 
We have a IPsec site to site tunnel from our main HQ router to a Cisco ASA 5510 in the core network in the colo.  This allows our HQ office to reach the private sub nets in our core without using a Cisco VPN client.  The problem we are running into is that this seems to be putting undue strain on the Cisco 2811.  I feel like the 2811 should be able to handle it but doing any kind of upload or download through the tunnel spikes the CPU/Interrupts and makes the router CLI basically stop responding until the traffic transfer is stopped or completed.  During this time, certain Cisco SCCP phones on our Broad works platform cycle while the SIP phones on the same platform are OK.  We are trying to alleviate the load on the 2811 by setting up a VRF from the HQ network to the private VRF used in the Core for private sub net communication.  The problem I'm having is the the HQ also has some public traffic that I do not want to include in the VRFs and would like to have it travel through the P2P circuit we have and access the internet or other public devices through the core public IP Internet routing table. 
 
The flow would be this:
-going to a public address use the public internet routing table
-going to private address in the 10.x.x.x or 172.x.x.x - use VRF to core Private network.
 
This is a little different of a set up from most of the VRF VPN examples I've seen.  Most of those the CE devices is completely private.  This is not the case at our HQ.