I got this working by using Tailscale, however I am a little uncomfortable having to disable my VPN (Cloudflare’s WARP). Would take any tips/advice for making that work.
To answer above questions, yes I am using the iPad as a remote. I had checked all the settings and found one mismatch where Roon Server was not in my list of firewall exceptions. I was able to manually add it. Regardless, it didn’t seem to fix anything, and Tailscale seems to be the only working solution.
Another oddity - I mentioned before that ARC works just fine, yet the Roon app settings page for ARC never seems to say it can connect to the Roon Server, even now with Tailscale installed and activated. I tried the “0” value for the port, still says Not Ready.