When configured and tuned properly, I've seen WireGuard able to move data at a little bit better than 90% of the provisioned bandwidth of the line. This in of itself is amazing and an order of magnitude better than OpenVPN or even IPSEC considering the overhead that encryption introduces into the packet size. Also, if you consider extra data processing going on, i.e. packets are being encapsulated, encrypted, transmitted, decrypted, and de-encapsulated, this is even more amazing.

These two form a "mesh VPN" which use direct encrypted links between any number of devices. You can think of it as forming a virtual LAN where you can communicate with devices, including open ports. A lot of them have clever tricks to overcome CG-NATs, which you seem to be struggling with.

Another option is to just rent a server. You can get massive storage space for less than some VPNs cost and you don't need powerful hardware if your device supports the codecs you're using. You could even get a cheapy VPS and reverse proxy to your Jellyfin server through an SSH tunnel or similar. Lots of options here.

I would recommend hosting a wireguard server yourself instead of using tailscale or zerotier (both go through their own servers with your data, instead of your data remaining within your reach). Wireguard is really easy to deploy using docker using the wg-easy image.