Yet another Wireguard server behind a main router issue

[psherman]

@JP89

I can add a static route to 10.16.8.0/24 subnet using 192.168.158.2 as gateway in my main router, then I don't have to enable Masquerading on the LAN zone in my Asus Openwrt router?

Yes... if your main router supports static routes. Not all consumer routers have this functionality exposed to the user, and ISP routers in particular often don't. But if yours does have the capability, you can add this route (and disable masquerading) and it should work. Masquerading on the lan zone should always work in your scenario, though.

@JP89

config wireguard_HomeVPN
        option description 'Pixel'
        option public_key 'redacted'
        option private_key 'redacted'
        option preshared_key 'redacted'
        list allowed_ips '10.16.8.2/32'
        option endpoint_host 'redacted'
        option route_allowed_ips '1'
        option endpoint_port '51820'

I would recommend removing the endpoint port on the peers. Likewise, on those devices (such as your Pixel), there should be no listen port specified (in the interface section of the configuration of the remote peers themselves).

This next section can be deleted:

@JP89

config device
        option name 'HomeVPN'
        option mtu '1500'

The firewall file only has two stanzas (the defaults and the lan zone)... is that the whole file?