I'm enthusiastic about WireGuard but I'm dubious about the "forklift" approach you describe. Actually, more seriously, I doubt in most cases that systems to be forklifted were truly secure originally and so while I don't think using WireGuard makes that worse, it may mean an opportunity is missed to fix more serious problems.

Presuming that by mTLS you mean mutually authenticated TLS, I don't see it as a good fit for internal systems - to me (as someone who has implemented mutual auth to considerable success) it's best where you have B2B applications, because you've got the three distinct parties that make a PKI worthwhile. Whenever I see a PKI in which all three of the parties are essentially identical I cringe, e.g. I keep seeing OpenVPN setups where one person runs the CA, runs the VPN server and mints all the private keys - the PKI is pure theatre in this approach, it makes no difference to anything.