OpenVPN -vs- Wireguard/Tailscale on pfSense/Unraid?

First off -- I'm not a newb, but I am only a dabbler. If you point me in the right direction, I can generally figure it out (often with lots of wasted time).

I'm running pfSense as a VM on Unraid (latest stable versions). I know, "don't vitualize your infrastucture!", but that's what I want for my home-lab. One box to grab from a fire/tornado/hurricane, or temporarily relocate during a power/internet outage.

I'm using OpenVPN on my "Deluge with VPN" docker to get to my NordVPN account for all my -arr stuff.

I'm using OpenVPN on pfSense which works great for remote access to everything Unraid.

I'm getting that "It ain't broke, but I wanna fix it anyway" sense that Wireguard (with remotes managed by Tailscale?) would be more efficient throughout?

My main question is -- where would I want to put Wireguard/Tailscale, pfSense or Unraid? Both?

I hear NordVPN supports Wireguard through "NordLynx", but does it? On both pfSense and Unraid? I really only need the VPN for my -arr stuff (which is low-priority) and could leave it on the Deluge-OpenVPN-NordVPN connection (which doesn't support Wireguard) except I think maybe there's a significant overhead penalty?

I think what I want is pfSense to manage two wireguard tunnels, one through NordLynx (for VPN/arr stuff), and one using Tailscale for remote access to Unraid dockers/VMs? But maybe it would be better for Unraid to manage the arr stuff and pfSense to manage the remote acess?

OpenVPN for everything has been fairly easy and just works... do I even want to invest the time in learning wireguard (Tailscale)?

Thanks for reading all this, and do you have any suggestions? Maybe a thread already here I missed?

¡Gracias!