Wireguard with cloud VM and 2 PCs. VM can ping both, both can ping VM, neither PC can ping the other

Question

2 PCs on a network behind a CGNAT (also tested with one on mobile hotspot) and a google cloud platform (GCP) VM being the DNS.

I can ping GCP from both PCs and can pi