Maybe you are overestimating it.

I wouldn’t truly know because I’m not a wireguard expert or anything.

That said, a “log machine” that you describe could just simply be a portable executable with root access on the vpn server machine. With this root access it could probably easily see what network connections are being made and potentially sniff them.

Maybe I’m wrong though. I don’t think it’d be easy to develop such an executable, but once made it could be portable, probably.

Unless you are a skilled network engineer/software dev in the field telling me it’s not possible, then sure I shall believe you.