What GPU and CPU is ideal for Penetration testing role job?

[royce]

PCI-E lanes are good for gaming, but hashcat does not care. x1 would even be sufficient for hashcat.

If you intend to use the system for multiple password-auditing purposes, a minimum of x4 might be good. Last I checked, JtR likes x4 for some workloads.