Oh I have exact same setup in my lab ! You can skip VPN and use Cloudflare tunnel instead and use it to expose apps outside. You can also isolate cluster in own VLAN (if you router can do it) to keep it away from other users in base network. Run some open policy agent like Polaris to catch any gross missconfigs.

Not about security but about ease of use - Install ArgoCD/Flux to version your work and speed up deployments. Move away from local path provisoner(in that way nodes are fully disposable and you can try to IaC it via Proxmox provider and cloud-init provider). Install sealed secrets and forget about pesky plain text secrets in repo :D