I'm using a 3B for it - it does not load it much.
I've used a pi zero-w for the wireguard and pivpn client successfully, but I did not test it for very long. It seemed to work fine. I stopped using it because the ethernet cable via mini usb hub and adapter was messy and a fragile connection.
1 Install PI operating system. I'm using Bookworm. I installed it headless, which I can give instructions for if you want (but it is all on the web).
1a Give it a static ip address.
2 I cannot remember the order I installed them in. From the dates on the repositories I installed pi-hole first.
3 To install pi- hole,
git clone https://github.com/pi-hole/pi-hole
then run the installer script, under 'unattended install'
4 To install pivpn,
git clone https://github.com/pivpn/pivpn
the installer script is called auto_install/install.sh
Choose the wireguard client on first install (you can have openvpn too).
pivpn is not being maintained, but it still installs OK. I use it because I am familiar with it.
5 Generate the certificates as needed from pivpn command
6 In your router set up port forwarding (note the port to be used when you install, to your pi).
7 I also installed a dynamic dns client on the pi, in my case this was something I forked from bulletmark/dyndns.
git clone https://github.com/shelleycat485/dyndns
(my change was avoiding passwords in log files, it's on the test branch)
You need to put a dyndns.toml file in ~/.config and edit that for your provider. The files you need to copy around are documented.
PS A Wireguard comparison DB says that a pi zero is going to be adequate. The pi-hole is a very low load.