I was advised OPNsense (fork of pfSense) implemented temperature monitoring. Please see below "what is normal." Temperature goes up with traffic.
Altought that range of this statistic is only 5°, it goes from 60 to 65. My APU2 with constant average load has around 57°. If the CPU got just little reasonable load, you might want to verify if your termal pads are correctly allign. It is curcial for this SoC Board to have proper cooling deployed. Rather disassemling it now, try to light from side to see if cooler + pad are in right place.
As a point of reference, my APU2C4 runs at about 55°C at idle, increasing to 57-58°C under normal load on my home network, running pfSense 2.3.2. My network load is low though - typical CPU load is around only around 0.2, and I have never observed it higher than 1.0.
My Firewall has been running for 3 weeks. Initially the temperature was around 70-75C. The trick I found to "cool the CPU was to use some of my old Hard drives and use the all heat thinks on top of the enclose. now the temp is between 62-66C
Not ideal but I have enough space in my rack and the disk where headed to the junk bin anyway.
I described in my post what I tried and the results.
Pads the thinner the better, 0.5 should be ok. However when we talk about thermal conductivity the most important is the pad from CPU to spreader. (the small one).
I ended up replacing the pad between CPU and thermal spreader with arctic silver thermal paste and polished less than half a millimeter from the raisers. This gave me about 3 degrees.
Later I drilled some holes on the upper and bottom part of the box and added a small 12V fan from ebay powered from 5V in order to be low noise.
The spike from the picture is without fan. I can post some pics with holes location, or fan mounting if you are interested.