Broonzy
Your 2 wireguard configs are identical save for the interface key? (Push edit tunnel to check MTU as well etc) a small typo is easy to miss.
iirc, 10.2.3.1/24 would not work and needs to be 10.2.3.0/24
You don't have include/exclude app rules in wireguard to exclude the app youre using to reach the server?
A device owner/admin app on your phone controlling global policies?
Did you try connecting via your server's IP instead of a FQDN (rule out dns)
Your server doesnt have extra access controls like requiring a certificate in your 2nd profile?
Lastly,
Accrescent app store > inter profile sharing app
(private space is another profile too)
Allow network permission for the app. It works even with full airplane mode and no WiFi. Share between profiles using this is an option.