I don't use VPN on my router. It's VPN on each device (separately) as and when it's necessary. Why? Much less setup & maintain work to do on the router itself, is the plus, but VPN subscription fee is the minus. Using Ethernet / 5G Wifi, via my router, the device's VPN Connection(s) are all sent through the VPN provider's firewall, they are all 100% hardcore anti-tracker enabled & DNS leak checked (my own setup choice is to exclusively use the VPN provider's DNS). You can use Multi-Hop Open VPN or Multi-Hop Wireguard (which is what I use). You can also have IPv4 VPN only or, IPv4 AND IPv6 VPN as you see fit and/or feel technically comfortable with (I always use the IPv4 AND IPv6 VPN option and I always use IPv4 AND IPv6 on my router too FWIW ). I've always triple checked everything i.e.
https://ipleak.net /
https://www.perfect-privacy.com/en/tests (I don't use Windows so the MS Leak test is N/A) /
https://www.dnsleaktest.com /
https://browserleaks.com/webrtc etc. There are many detailed online tests available as you'll probably know better then me, but the WebTRC Leak Test is
perhaps the one, many people forget about when verifying their VPN for leaks.
There's never a perfect answer/ perfect solution
@SomeWhereOverTheRainBow & lot's of people will stick with the router config option, but it does remove any of those ^ IPv6 'backdoor leak' issues.