If you want remote access to your home services behind a cgnat, the best way is with a VPS. This gives you a static public IP that your services connect to, and that you can connect to when out and about.

If you don’t want the traffic decrypted on the VPS, then tunnel the VPN back to your homelab.
As the VPN already is encrypted, there is no point in re-encrypting it between the vps and homelab.

Rathole github.com/rapiz1/rathole is one of the easiest I have found for this.
Or you can do things with ssh tunnels.

For VPN, wireguard is very good