yw
Since 2.5GbE (theoretical) max throughput is about 312MB/s, a PCIe2 x1 lane (theoretical max of 500MB/s) is entirely sufficient for such a device.
It looks like (I believe) that the CW engineers split two of the nine PCIe3 lanes into four PCIe2 lanes, each of which are designated for the i226-V 2.5GbE ports on the AL-4L-V2.0
This leaves us with seven PCIe3 lanes.
Five PCIe3 lanes (x4 + x1) are dedicated to the m.2 interfaces.
The remaining two are bifurcated/distributed amongst the remaining port interfaces (etc.).
I'm not really that good at doing algebra in my head (and I only have 1GbE networking equipment running atm), so this explanation makes sense to me.
See lspci output attached:
View attachment 32721