Hi @semmour,
It appears that you have the same network segment at the HQ site on WAN R1 and the LAN of the Peplink, you may want to correct this. At the HQ site, it would be preferable to have the R1 & R2 modem/routers in bridged mode to pass on the public IPs to the Peplink. You can utilize the built in DDNS or Find My Peplink functionality built into the WAN links to keep an associated hostname updated with the current IP.
With public IPs on the WAN links at the HQ site you can then build the tunnel(s) from the remote sites to the associated IPs or hostnames of the WAN links at HQ. When NATing to the WAN you cannot build a tunnel to that link without port forwarding setup, just unnecessarily complicates things.
As a general rule of thumb, the HQ site should have public IPs on the WAN(s) to facilitate peers building tunnels to the site from behind NATed devices ie. ISP modem/routers or a cellular link, etc.
I hope this helps.