I just recently switched to an ISP that uses CGNAT. I needed a way to access my Plex server remotely now that I didn't have a public IPv4 address. Thankfully for most of my other web hosted projects, I was able to use Cloudflare tunnels. But it's ambigous if Cloudflare is okay with you using Tunnels for Plex traffic.
Instead people suggested buying a VPS and hosting a VPN (like Wireguard) to route your traffic through. I couldn't find a complete guide to do this. I struggled for a couple days with trial and error until I finally found a configuration that worked. I wanted to document this for anyone else in the same situation (and future me).