Basically we should be using >=TLSv1.2, P-256 as the preferred curve and the following ciphersuites:

'TLS_AES_256_GCM_SHA384',
'TLS_AES_128_GCM_SHA256',
'TLS_CHACHA20_POLY1305_SHA256'
'ECDHE-ECDSA-AES256-GCM-SHA384',
'ECDHE-ECDSA-AES128-GCM-SHA256',
'ECDHE-ECDSA-CHACHA20-POLY1305',
'ECDHE-RSA-AES256-GCM-SHA384',
'ECDHE-RSA-AES128-GCM-SHA256',
'ECDHE-RSA-CHACHA20-POLY1305',

Given that we are talking about server<-->server traffic and AFAIK we got AES-NI available in the whole fleet the AES ciphersuites should be a tad faster than the CHACHA20 ones (already ordered taking this into account). ciphersuites starting with TLS_ are TLSv1.3 ones