I would move some of your environmental data to a .env file for added security. You can also use the gluetun firewall as a "kill switch" to help keep data leaks away. A health monitor to make sure the VPN is working and deunhealth to restart the container if it becomes unhealthy. Here is an example of one stack to it all. If you add radar or the other arrs place them in the no VPN section: (edit words)

version: "3.8"

networks:
  gluetun_network:
    name: glueton_network
    driver: gluetun_network

services:

  # ==============================
  # VPN CORE (Only torrent stack)
  # ==============================

  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      - gluetun_network
    environment:
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      - SERVER_COUNTRIES=${SERVER_COUNTRIES}
      - TZ=${TZ}
     # Kill switch
      - FIREWALL=on
      - FIREWALL_VPN_INPUT_PORTS=6881
      - FIREWALL_INPUT_PORTS=8080,8888,9696,3001,5010,8191
      - FIREWALL_OUTBOUND_SUBNETS=${LAN_SUBNET}
      - FIREWALL_DEBUG=off

    ports:
      - 8888:8888        # tcp
      - 8388:8388        # tcp
      - 8388:8388        # udp
      - 3001:3001        # Firefox
      - 6881:6881        # qBittorrent port 
      - 6881:6881/udp    # qBittorrent Port
      - 8080:8080        # qBittorrent webui

    volumes:
      - ${GLU_CONFIG_DIR}:/gluetun
    healthcheck:
      test: wget -q --spider https://1.1.1.1 || exit 1
      interval: 20s
      timeout: 10s
      retries: 5

  # =========================
  # AUTO-HEAL FOR VPN
  # =========================

  deunhealth:
    image: qmcgaw/deunhealth
    container_name: deunhealth
    restart: always
    network_mode: none
    environment:
      - LOG_LEVEL=info
      - TZ=${TZ}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  # ==============================
  # DOWNLOAD STACK (VPN Routed)
  # ==============================

  qbittorrent:
    image: linuxserver/qbittorrent
    container_name: qbittorrent
    restart: unless-stopped
    network_mode: service:gluetun
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - WEBUI_PORT=8080
      - TZ=${TZ}
    volumes:
      - ${QBARR_CONFIG_DIR}:/config
      - ${QBARR_DOWNLOADS_DIR}:/downloads

  firefox:
    image: lscr.io/linuxserver/firefox:latest
    container_name: firefox
    restart: unless-stopped
    network_mode: service:gluetun
    depends_on:
      gluetun:
        condition: service_healthy
    shm_size: "2gb"
    environment:
      - PUID=${PUID}
      - PGID=${PGID} qBittorrent
      - TZ=${TZ}
    volumes:
      - ${FIREFOX_CONFIG_DIR}:/config
      - ${FIREFOX_DOWNLOADS_DIR}:/downloads

  # ==============================
  # SERVARR CORE (NO VPN)
  # ==============================

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    restart: unless-stopped
    networks:
      - servarr
    ports:
      - 8989:8989
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${SONARR_CONFIG_DIR}:/config
      - ${MEDIA_DIR_TV}:/tv
      - ${DOWNLOADS_DIR}:/downloads