Wireguard and DNS filtering (albeit not as fine tuned and automatic as pihole) can all be done on OpnSense
I recommend OpnSense on whatever modern low-power hardware you can get your hands on, ThinkCentre, NUC or whatever, if you are okay with a separate device for WiFi or do not need WiFi. WiFi APs can be had for as low as 20 bucks and are usually straight forward to set up, but you gotta shell out more if you want the latest and greatest connectivity.
There is also the possibility for adding WiFi directly to OpnSense but I have not even bothered touching it. If you love tinkering and suffering, that’s a route you can go.
For the love of God, if you’re going to install PfSense, just get OpnSense instead. It’s just better.