The problem of performance was because I thought that whitelisting the syscalls en nspawn with --system-call-filter will improve the performance, but as they explained me in systemd mail list I should use export SYSTEMD_SECCOMP=0, because nspawn will still be processing syscalls when I whitelist them.
SYSTEMD_SECCOMP was added in systemd v247 (debian buster ...
You can simply pause or stop your virtual machine then simply copy the .img, .raw or .qcow2 as the backup.
But i have suggestion for you: you can use easily get a snapshot.
get snapshot with qemu-img:
qemu-img snapshot -c backup /vms/vm10001.qcow2
or virsh command:
virsh snapshot-create vm10001