Does VyOS support L2TP with Public IP over the tunnel (like pfSense does with CoreTransit)?

Try using WireGuard AllowedIPs Calculator | Pro Custodibus to calculate an allowed ip list for WireGuard minus the L2TP server IP and / or subnet.