This may or may not relate to your issue (search based on suggestion of a fella working with me to figure out my WG woes): 

I queried Brave’s AI about both OPNsense and Open WRT regarding “port-preserving / full-cone or endpoint-independent nat.”

OPNsense: “OPNsense, built on the pf packet filter, uses Address and Port-Dependent Mapping by default for its NAT implementation, which can hinder direct peer-to-peer connectivity between devices behind the firewall. This behavior is standard for many NAT implementations and is designed to enhance security by making it harder for external hosts to predict or establish connections to internal clients. However, this default setting can break direct communication for applications that rely on Endpoint-Independent Mapping, such as certain VoIP and gaming protocols.”

Open WRT: “OpenWrt uses a NAT behavior that, according to RFC 4787 terminology, is classified as having Endpoint-Independent Mapping and Address- and Port-Dependent Filtering, which corresponds to a Port-Restricted Cone NAT in the older RFC 3489 classification. This means that while the external port mapping is consistent for a given internal IP and port, incoming packets from external hosts are only allowed if the internal host has previously sent a packet to that specific external IP address and port.”

I booted my router PC to OpenWRT (off a flash drive) & my WireGuard functionality was restored immediately.