I indeed think this question is not easy to answer, as there are too many knobs or variables you can turn on. What classifies a small/medium/large project? Is it big in Gigabytes because it serves videos? Or is it small considering the disk space of the content, but on the front-page of the news resulting in insane numbers of requests? Is it optimized for traffic? Is 90% of the traffic handled by a CDN that sits in front of the small webserver that (hopefully not) sits under a sysadmin’s desk? I think you get the direction of thinking: It depends, a lot.
But to give you two real-world examples:
We run >40 Neos 5.3.x instances on a single server with 8GB Memory, 4 vCPUs (with 4 Cores each) and 200GB of Disk, but these are smaller sites that don’t get too much of concurrent traffic.
Or we run a larger website of one of our international customers on a dedicated host with the exactly same specs, but that one get’s a lot more traffic in comparision to the smaller websites mentioned before (and of course there are websites that are tens or hundreds of times bigger compared to this one).
All of our setups run on virtual servers hosted ourselves and I’s say the sizing is “big enough to not cause monitoring alerts every few days”, and neither oversized or optimized to be bone. No CDN at the moment - this would of course reduced server size requirements on our end, but add more complexity to the project (another thing to take into consideration IMO).
Hope this helps to get a first idea.