Thanks for the suggestions.

I see no CPU spike on the VPS, and no CPU spikes on the clients.
I use WG started by root using wg-quick via systemctl on all devices.
I tried setting the MTU to 1280, with no significant changes, apart from slight slowdown compared to MTU of 1420 or 1440.
Smaller packet size also resulted in slightly lower speeds.

I used tcpdump on both client and server to find the negotiated MSS, and it shows an MSS of 1460 outside wg tunnel, so by following the calculations shown in this article procustodibus.com/…/wireguard-performance-tuning/, 1440 is the correct MTU for the wireguard interface when using IPv4 inside the tunnel.