Safest and fast - Wireguard. But you need to setup duckdns too.

Safest and easiest - Tailscale. It’s a userland implementation of Wireguard with added stuff to make it stupidly easy to run. But because it’s not a kernel module, it’s slightly slower.

Oh… Look at that…

You use arch BTW

It seems to me, by looking at several of OPs comment that you’re running the full desktop OS, with Gnome on it, and honestly that’s the reason you get the idle CPU and 1.5GB of RAM usage.

Do you want light weight the real answer is, use the server version of it without the UI.

Remember to never run anything critical on Windows