Windows Packet Filter demo package contains a sample named GRETunnel, which demonstrates how to attach/remove new headers to/from the network packets. Add GRE payload encryption and you get a simple VPN tunnel.
This another sample which with a different approach. It redirects selected TCP connections to the local proxy and then forwards theese through the SOCKS5 proxy. Just add an SSH client with SOCKS support (PuTTY, an example) and the result is VPN over SSH tunnel.
So, basically with winpkfilter you have everything needed to implement any type of VPN. The details depend on your concrete needs. An example, for Wireguard implementation you should insert/remove UDP headers (plus some protocol specific data) instead of GRE, but the idea is the same.