Heard a lot about pfSense, but it's always sounded like overkill to me

This is why I waited long before trying it. Paradoxically, pfSense is much easier to use than it seems. In less than an hour I was able to install it, configure it as a firewall, OpenVPN server, Ads Blocker (pfBlockerNG) and set a let's encypt certificate for the admin dashboard. All through the web panel, simply filling in the fields and checking the checkboxes. I do not know how difficult it is to install and use Pi-Hole, but OpenWRT and Gargoyle (router) were really much more complicated than pfSense

Do yourself a favor and try pfSense. I had a PI with OpenWRT on it, and recently I Switch to an x86 firewall just to try pfSense. Best choice of the month (almost, for me!)