Is it possible to track bandwidth usage of different VPN accounts using PF?

[Some Developer]

I have a VPN server configured using L2TP and IPSec. Clients 
authenticate using x509 certificates but I'd like to be able to be able 
to track the bandwidth used by each client based on which x509 
certificate they used to authenticate with the VPN.

I know that you can track types of connections etc with PF but I'm not 
sure if you can track packets based on authentication such as this. Is 
this possible to do at all?

I'm still quite new to PF so I'm still trying to get an idea of what it 
is capable of.