The problem her was that this wasn't a traditional update. It was delivered automatically as a "content" update (like how old av would have definition update). We were given no room to test.
Enough people have already commented on the "proxy at the vps solution". Another option is to configure routing and nat on the VPS and have it route over the wg tunnel.
Requires you to have postup/predown scripts that modify your routing tables on the wg endpoint.
I made the plunge about a year ago. Spectrum assigns me a prefix but routing was spotty at best. In the end after all the troubleshooting pointed to the problem being the ISP I gave up and stuck with what works, IPv4.
DDOS protection is going to depend on the VPS. But for most services you could spin up a pretty lean Debian vm running a proxy like nginx proxy manager and run that over the tunnel. Something like opnsense seems like overkill.
I gave it the old college try about 6 months ago. Found out how to send the req for a subnet to my ISP. Configured my opnsense. When it worked, it worked. But it would randomly stop routing regularly. After a lot of troubleshooting determined it was the isp and have up.
For Excel there is a PowerShell module called Import-Excel that I use all the time.