When saying "It appears the router doesn't wake up my work machine over VPN which R7000 used to do just fine.", I guess you mean you use the 'QuickVPN' feature of the DIR-880L to access your LAN via an L2TP over IPsec VPN? Just to be sure and have a common understanding of what we talk about.
If so, I would assume your VPN client gets an internal IP address that is out of the IP address range of your home LAN? If so, your VPN client is logically a member of your home LAN and hence it should be enough to configure your WOL tool on your VPN client to send the WOL magic packet via standard broadcast in order to wake up your work machine.