So without haveged (or something similar as we don´t have a hardware random generator) the solution is to wait for “random: crng init done”. This delays the start of wireguard connections which might be undesirable in testing environments, especially to test new wireguard setups.
When I set up my device with a new wireguard installation I ran into this problem… and searched for firewall/routing issues until I figured out the entropy thing. When anything works as intended haveged can be disabled.