First step is to tcpdump on the actual WAN interface and then on wg0,
while pinging from outside, and see if you see plausible ciphertext
pings arriving and then decrypted icmp echo request on wg0.
Then see if you see replies on wg0 and plausible ciphertext replies on
the wan interface.
If not, then ping from the local machine and watch as well.
read the man page for 'route get' and run that, to see how outbound
packets are routed.
finally, turn on ip forwarding, even if you know it doesn't matter, and
see if that changes anything, because it's an easy experiment.