If mulvad didn’t take away the ability to just dump your VPN in your router via wiregaurd I would say do that over running the VPN on the system. Use an openwrt capable router and google a good saftey guide.

Probably something that is so basic or integrated into the distros I use that I forget about it because every time I use it, it just works.