How to block local VPN traffic that's not through wireguard

It's looking like v4.8.x wasn't a 'stable' release for a couple of devices then: