Incoming traffic on WG interface behind ISP modem

The Wireguard tunnel is working correctly, in the sense that any host in the wglan zone can connect to any host in the pfSense network. So there actually is a route to anywhere in the tunnel already (because of the list allowed_ips '0.0.0.0/0). Or am I not understanding your point correctly?

This is the routing table:

My thinking is, OpenWrt actually receives the ping over wgwan, but the reply is sent via the main routing table to the 192.168.2.254 gateway. Although that wouldn't explain why it works in my second setup.