I am configuring a private cloud at home using nextcloud on a linux machine. It is running an apache webserver over an https connection (let's encrypt self-signed certificate) and a VPN server (wireguard). The goal is to access, on the move, to information stored on nextcloud's webdav server (it can be personal photos, personal bank reports or finances, contracts, etc) and I would like to fully understand the risks of this approach, namely, the risk of that information being exposed on the internet to others (being hacker or my ISP, if I'm feeling that paranoid).
An example use case: I connect my phone to my VPN server located at home, access my nextcloud webdav server and download + upload several documents.
In this scenario: who or what can see what I am doing, or what kind of documents I am working on? Is it possible for a hacker to get hands on the information? Or my ISP to "see" that I am sending or receiving documents of a specific kind, and their filenames and/or content?