Thanks for the suggestions. The WireGuard tunnel doesn’t seem to be the issue, as it’s configured to allow all IPs (0.0.0.0/0, ::/0).
I’ve tested again to be absolutely sure that connection tracking on my side isn’t the problem by completely disabling the firewall and clearing the conntrack table. However, the issue still persists.
I’m currently in contact with my upstream AS, as I suspect they may also be performing some form of connection tracking, which could explain why I don’t see any packets at all.