Background:
Cilium has been installing no-track rules for its own IPsec traffic for a long time, and recently also started to exclude its own overlay traffic (#38782). But its own Wireguard traffic is still unncessarily tracked by the kernel:

kubectl exec -it -n kube-system cilium-hm9wh -- cat /proc/net/nf_conntrack | grep udp
ipv4     2 udp      17 116 src=172.18.0.2 dst=172.18.0.3 sport=51871 dport=51871 src=172.18.0.3 dst=172.18.0.2 sport=51871 dport=51871 [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 zone=0 use=2

Proposal:
Also exclude Wireguard from in-kernel conntrack. On egress this could simply re-use IPsec's mark-based matching.