CIS is capable of filtering TAP adapter but did not support the TUN adapter.
However, I was toying with the latest beta 8124 and it looks like it has started to support TUN adapter and Wireguard protocol. Could you test this? I made a post about in the release topic of 8124.