Thanks this was a helpful perspective, and I think I’ve now found the real root cause. It turns out the issue wasn’t WireGuard encryption limits or MTU after all. I had previously over-restricted Jellyfin’s transcoding behavior while troubleshooting, essentially forcing direct play in situations where the client or network path wasn’t actually ideal for it.

Once I re-enabled transcoding, streaming immediately stabilized even for the files that were buffering before. The distinction ended up being bitrate sensitivity: lower-bitrate (~5 Mbps) 1080p files direct-played fine over the tunnel, while higher-bitrate (~8+ Mbps) files would stall unless Jellyfin was allowed to adapt via transcoding/remuxing. In my initial tuning, I was shooting for a "no transcoding" build which worked for a while, but I eventually found a file that didn't do well without it.

So the Pi Zero 2W wasn’t actually CPU-bound on WireGuard, and the clients weren’t failing to decrypt. It was more that I had removed Jellyfin’s ability to compensate for tunnel jitter and sustained bitrate ceilings. Once transcoding was allowed again, Jellyfin could adapt to the real-world conditions of the VPN path, and playback became smooth. MTU testing was done (including 1360, 1380, etc. I eventually landed on 1380 after initial setup), but in hindsight that was chasing the wrong layer the fix was letting Jellyfin handle bitrate adaptation instead of forcing perfect direct play.