Addendum:

> I doubt Varisys simply forgot to use more than two PCIe controllers, but believe
> there is a good reason for using only two of them. It might be connected to the
> fact that the board has been designed for three different SoCs (P3041, P5020,
> P5040) which are not 100% pin-compatible, so the actual board design
> represents the lowest common denominator between the three SoCs.

I just remembered that 6½ years ago, Jim and I discussed the SerDes assignment options for the P5020's PCIe controllers:

http://morph.zone/modules/newbb_plus/viewtopic.php?forum=3&topic_id=7183&start=154
http://morph.zone/modules/newbb_plus/viewtopic.php?forum=3&topic_id=7183&start=177

As can be seen, the most sane PCIe config for the P5020 used in a desktop computer would have been x4 x4 x1 x1. Now as the P5040 lacks the fourth PCIe controller, this option can't be used on the board, so Varisys had to use the next best option instead, which is x4 x4 (with bridging the 2nd x4 to x8). And even if there was an x4 x4 x1 config for the P5020 (which there isn't), this would have resulted in only 1 lane more (or 3 lanes less without the bridge for the 2nd x4).
I think this should explain why the Cyrus board only uses two PCIe controllers.