By default, nRF Cloud CoAP traffic appears in a modem trace as encrypted DTLS records, so Wireshark cannot show the CoAP and CBOR payloads.
The modem exposes the session keys to Nordic tools when the DTLS connection uses a security tag in the reserved developer range NRF_SEC_TAG_TLS_DECRYPT_0 to NRF_SEC_TAG_TLS_DECRYPT_19 (2147483648 to 2147483667).
Building the template with the CoAP security tag pointed at one of these tags gives you fully decoded nRF Cloud traffic in Wireshark.
Warning
The developer security tags are intended for development and testing only. Any trace captured from a session that uses them can be decrypted with Nordic tools. Never ship production firmware configured this way.