This issue has been raised several times now, but not been resolved (only "workarounds"). See e.g. https://vyos.dev/T6097 or https://vyos.dev/T6073

Always are veth interfaces involved.

I just set up a relatively simply setup to allow wireguard with Multi-WAN where the WAN is not in the same VRF as Wireguard, and I used veth to tunnel the traffic from the WAN vrf to the default VRF.
Wireguard was never able to complete the handshake, it always sent out traffic to the wrong port. Removing vrf_zones table solved the issue.

Just another reason why we need https://vyos.dev/T8496 - without tools such as PWRU, this is just guesswork.

I don't yet know WHY exactly the current approach is wrong / breaks with veth. Simply, because I cannot properly debug (without custom kernel...)