+1 for antiX. Although make sure to disable all locales you don’t need or you will be in for a looooong ride when updating on an old machine.

The siblings could run
tailscale ping nodeIP/nodeName
This not only shows if they are connected via a DERP (relay) but also retries to connect them directly a few times.
If that doesn’t work out it can sadly be quite hard figuring out why a DERP is used instead of a direct connection.