You have a triad (much like time, money, resources) of the Internet:

1. Privacy 2. Security 3. Anonymity

Wireguard covers everything except your endpoints (anonymity).

Adding any more wrapper of a non-routing protocol will leak even more info: I can safely say this as one who creates filters for IDS/IPS/NDS/XNS.

If you want to cover the last vestige of your endpoints and not lose any more info, you would use a routing-type protocol, encrypted or not, onion-layer or not.