Risks of Cloudflared / WARP vs WireGuard for Personal Web Server

I up until about 2 years ago used SSH keys for remote access to my personal web server/home environment. 2 years ago, I bought a Unifi Dream Router 7 and with that router, it has a built-in WireGuard client, so I started using VPN a lot more. The VPN is great, does what I want, allows access from pretty much everywhere - but it has one small snag: I recently switched from T-Mobile to Visible+ Pro - and with that, I'm trying to reduce intense data use a bit so they don't cut me off. I'm hopping on WiFi networks a lot more now. I'm finding some WiFi networks such as certain hospital guest networks block Wireguard and among other things Kalshi. I researched this some, and came to the conclusion that setting up Cloudflared on my server with WARP access should in theory fix this problem - have not tested the specific use case yet - but it works for everything else pretty much seamlessly - apps I wrote for my phone communicate just fine with my private SSL cert / domain name I have mapped to 192 168 1 2. The user security seems straight forward - actually better in some cases. If for example due to recent laws in the US want to uninstall any reference of my VPN before traveling internationally, I can easily remove the app and then re-install it w/ my GMail account instead of having to try to regenerate a WireGuard.conf file. A lot easier to set up. More modern - I gather most of corporate America is moving away from VPNs and moving towards ZeroTrust such as Z-Scaler or Cloudflare One - so knowing this tech makes me know more for my career. The only risk I see - is that there is a slight risk Cloudflare can decrypt the traffic / shows it passing at their ingress/egress points. But since I don't have TLS inspection on - I'm not sure how much the decrypt risk is. Since my personal web server has a purchased SSL cert - it's probably encrypted just as good as anything else / the VPN keys, etc. Unless SSL encryption is very weak, I'm not too concerned about that. Any real server commands I run would be ran over SSH through the Cloudflared tunnel, so those would be encrypted too. I can't think of any instance where interactions are not encrypted in some form through the tunnel. If anything, it should make me less likely to be port scanned as my public IP is not showing up as UDP traffic on various WiFi networks now. Thoughts? Would you do this? Would you not? Concerns? I'm kind of at a 50/50 point right now on if I want to do one or the other all the time going forwards. Cloudflared is a LOT easier logistically to manage. But it's not my VPN. But at the same time, someone who really wanted to hack in and read the traffic - in some ways they could more easily take over my router than Cloudflare's servers.