I have a web server with a separate database server in this case a MongoDB, both are hosted on EC2, but when connecting my webserver to my database server is it best to use the public IP address or the private local one (10...*).
I'd like to have the best performance and security.
You want the private IP address for that. The public IP should only be used for public-facing services, and your Mongo is not such a service.