I updated to the latest kernel, and basically once wireguard starts up in a nested container I get a page fault/panic.
Jan 20 14:07:08 pve kernel: [ 44.267836] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
Jan 20 14:13:24 pve kernel: [...