How does the connection actually happen? Like for two home users with dynamic IPs, nat, firewall, and/or CGNAT?

It doesn't use IPs at all, otherwise there would be no privacy. Everything goes through Tor. Each PeerBox instance gets its own .onion address, and all connections are made through that. Your contacts never see your IP, you never see theirs. SSH handles the authentication and encryption on top of that. So NAT, dynamic IPs, firewalls, CGNAT, none of that matters. You don't even need a VPN, Tor already maxes out the security.