I can't really say there's any one firewall that works better then the others. What I can say is that most any firewall you can buy in the $150 range will work great for most fairly large networks. We've had real good results with clients using Asus RT series of routers/firewalls.
Any built-in modem router is usually garbage, and any $40 router from Walmart is garbage. They just aren't built to handle the sheer number of UDP Packets Per Second that SIP audio throws at it. They are meant for large TCP workloads like streaming video or playing video games. SIP is unique in that it has a very high Packets Per Second and uses UDP for the audio stream. Most cheap routers just do NOT have the CPU needed to process a lot of UDP.
We've also had some of the more saavy clients use Linux or BSD based firewalls with great success. PFSense, Untangle, Shorewall, etc. Some are more use friendly then others. About half of them have moved to a free with paid add-on's business model. I'm a fan of Shorewall but it's about the most unfriendly one out there short of configuring IPTables or PF itself. These all scale like you wouldn't believe on the crappiest of hardware too. A $100 ITX server will outperform a $1000 piece of Cisco gear. Pretty much all of these require you to be somewhat familiar with the underlying OS.
As far as the big stuff goes from vendors like Cisco, Juniper, Adtran, etc, we usually have issue with over-zealous security settings. Sometimes this is just how it's set by default, but over half the time it's because someone who specializes in XYZ piece of equipment feels the need to enable EVERY feature to justify their existence. I'm sorry, but a network with 140 endpoints does not need OSPF and segregated VLAN segments for every switch in the organization. I also shouldn't need to hit more then one gateway to get to the internet.
Ohh, and I hate SonicWall. I'm told they recently figured out how to make SIP work, but I don't care. Only ever had 1 client get SIP working across a SonicWall and now they're afraid to touch it because it might break.
Most of what I see breaking sip is just router configurations more then the hardware. Here's what I usually have to Fix:
1) Disable any SIP Helper, SIP ALG, SIP Deep Packet Inspection, Etc.
2) Disable IDS/IPS or DDoS Protection for the carrier's IP (or just disable altogether)
3) Correct port forwards for BOTH SIP and RTP ports
4) With multiple SIP devices, usually need a unique RTP port range for each one
The Meraki stuff looks like a great option if you are an MSP. That way you can manage the clients network without having to go on site or remember all their random credentials.