Ok, ran into the exact same issue mentioned here: WireGuard noob challenges - #7 by daz.wilkin
Ended up switching from ewr to sea to get it to work, now all the bits seem to be flowing.
Now it’s working! Got ssh root@<private-ip> to connect sucessfully.