Just a theory: There is a good chance that your provider does CG-NAT and that was the issue with OpenVPN. These would persist with wireguard,sadly, unless you solve them properly. (Which can be tricky). But just for the book: Running an Wireguard Container behind your router and have a port forwarded to it is an option. (But still needs CG NAT adressed)

Thaft leaves you with a few options:

• Cloudflare: Imho a bad idea - it’s evil, it’s monopolistic and while it’s “an easy way” it has its technical downsides. As you said a domain is still required.

• Use a small VPS and run a wireguard tunnel and maybe pangolin as a reverse proxy on it.It has the benefit of being very flexible and once configured is fairly stable and it puts the security part outside your network. But it costs money unless you maybe make it work on oracle’s free tier. I would still recommend using a cheap domain,though)

• As others have mentioned: Tailscale/Zerotier/Netbird absolutely are an option if it’s just for you. But they get nasty if it’s for more people or larger deployments.