Question,
First, do you have a video other than Hosting Behind CGNAT With Wireguard for how to use CGNAT or does it need the VPN?
Second, the use of the CGNAT has to be on the primary pfSense correct, not a VM or secondary. If you have a another pfSense as a VM and/or other console, it has to reference/forward to the primary pfSense machine/console that is connected to the internet via modem correct?