The typical painpoint is the low maximum buffer sizes.

net.core.rmem_max net.core.wmem_max

e.g. wireguard-go will hit those limits of not executed with CAP_NET_ADMIN.