I can't speak to Veeam as I haven't used it recently.
Are there performance differences between the two products? - this would require testing
I would like the App and DB Server Replica's to be as in sync with each other as possible - ie replicated at exactly the same time, if possible. - not sure if Veeam supports cross-VM consistency groups. This isn't supported by vSphere Replication. Just curious, why do you want your app and DB servers in sync? During normal operations changes should only be being made to the DB.
What is the impact on the Source site of repeated replications using each product when both when using Application Consistent Replication and not? - again can only speak to VR, if you aren't using application consistency the impact on the source is minimal as VR uses the vscis filter and light weight deltas to track changes instead of snapshots. When using application consistency/VSS VR will use snapshots in order to quiesce the application.
Do I really need to use Application Consistent Replication for such a system or is Crash Consistent adequate (but sure to work in time of failover)? - this will depend on your application. More than likely with how new it is I would think crash consistency would be fine. I recommend testing it though.
Time to bring Replica site up after failover? - depends if you are using VR by itself which requires manually recovering each VM or with SRM which will automate the process. Also depends on how many VMs, defined dependency order, start up time, etc.
Performance of Replica site upon failover (bearing in mind that snapshots seem to kill DB performance)? - VR only uses snapshots on the recovery site if you are retaining multiple points in time. If you do use MPIT, I'd recommend consolidating ASAP after failover.
Testing Remote Site's consistency whilst not affecting Master site application - I'm guessing you're talking about bringing up the replica without impacting the source? This is supported when using SRM, not with standalone VR.
Only a single VCenter server (possibly an issue with VSR - perhaps the mitigation is VCenter 6.5 HA)? - VR is supported with a single vCenter. SRM requires a vCenter at each site.