I am not a pro in this matter but, apart from what you have mentioned in your post, one thing to speed up is to run your application after kernel and before systemd init, then call systemd init from within your application.
One nice post I found which details optimization in various levels is this one.
Note: I would like to learn from you how you managed to ...
The Pi3A was released on 15 Nov 2018.
Any OS older than this won't work, although you COULD try updating kernel and firmware from a later release.
NOTE DO NOT use rpi-update (at least without selecting a Stretch compatible release - which is not quite straightforward).
Running sudo apt-get update; sudo apt-get install --reinstall raspberrypi-bootloader ...
I haven't followed the tutorial you used but wireguard is heavy under development and there are some outdated installation tutorials on the web. Try this Wireguard installation that uses an official backport from Debian Bullseye. I have just tested it again with success.
The problem is this:
/busybox: ELF 64-bit [...] dynamically linked
This is totally normal -- I suspect you have some idea of what this refers to, since you tried ldd on it -- but of course what it was linked to when compiled were 64-bit userland libraries that you do not have.
There are two things you can try:
According to a comment on r/Wireguard, this error is caused by having the wrong kernel headers:
dkms packages (wireguard-dkms this time) need kernel headers for
current kernel you have loaded (uname -a). As long as kernel is
updated through apt or aptitude you should not run into problems, but
if you update kernel with rpi-update you'll likely get newer ...
There is no easy way to do this out of the box. With systemd you have to listen to D-Bus messages to find out when a connection is established. Try networkd-dispatcher, as suggested in the post.
You can run scripts depending on the link operational status. Interface name, among some other parameters, is transmitted to your script as an IFACE environment ...