That all sounds correct to me. The random port you're seeing in the logs is a high port, often referred to as an ephemeral port, and it is common for source ports. All good there.
You don't need haproxy on the vps at all, unless I'm misunderstanding you. Just route the traffic using iptables hooks in your wireguard config. This is exactly how I manage my email server and it's entirely transparent.
Yeah, put that trash in prison!