First, if you're running the DB server on VM, why not add some memory and a vCPU or two? We run a lot of clients through our ePO server (20k+) and we've never had a performance issue running large queries against it. It'd be a lot cheaper in time, effort, and complexity to just beef up your DB system.
How does your security team do their queries? Do they create queries and reports in ePO, or do they run queries directly against the database? If they do it in ePO, can you schedule those reports and queries during off-hours and e-mail the results to the InfoSec team?
If they run directly against the database, you can automate replicating the database to a remote server and mounting that database, and then your InfoSec team can run queries directly against that DB. Make sure you test the size of your database, though. I think mine is approximately 40 GB, and if you're putting that across a WAN every night, that could cause other issues.
The upgrade of existing infra scheduled to next year - not sure when.
The security Team runs multiple queries from ePO console and from SQL as well. and we have automated so many things in ePO so we have performance issues as well.
So I have doubt that if I setup additional ePO server (will not be register to primary ePO) then is it possible to access that replicated DB so InfoSec team can access and run query on ePO and DB on their schedule ?