I also have an SSID that doesn't get VPN'd, though my DNS is always VPN'd.
As for accessing JellyFin, etc., I think we have somewhat different setups. My self hosted services are by default accessible without a VPN (SSID is on a VLAN with e.g. 192.168.0.0/24, servers are on 192.168.1.0/24, router routes between them). For the blanket VPN'd SSID I have a routing rule that routes over the main, not VPN, table, so local services can be accessed.
So: local traffic has a rule to route without VPN, reddit routes with a specific VPN, and general traffic routes with a different VPN.
There are lots of VLANs involved in my setup, and I'm sure it's overly complicated and has gaping security issues, but it's just a home network and it's kinda fun :(
Yeah, one of the issues I was having with running VPN on router is that you need a somewhat beefy router if you want to use your full bandwidth---my router maxes out at about 90Mbps with WireGuard, even though it can NAT around 1Gbps (which is our service).
I implemented two workarounds, one was to use my access point as a VPN router since it had a beefier CPU, and the other was to just use an ARM SBC with Linux to handle that task. (I ended up with the latter, as the former ended up maxing out at around 400Mbps, and introduced some additional headaches.)