I'm not sure why have 3 addresses for VRRP. So what are you trying to do?
Assuming you have one ISP with a /29... In theory, each router gets one public, and the VRRP WAN get one... so 3 publics needed. And you need a src-nat rule to use VRRP address as src-address.
Basically something like this:
:global "vrrp-public-IP-address" 2.2.2.2
/ip firewall nat
add action=src-nat chain=srcnat comment="enabled if master" disabled=yes out-ipsec-policy=out,none interface=ether1 to-addresses=$"vrrp-public-IP-address"
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/interface vrrp add interface=ether1 name=vrrp-wan \
on-backup="/ip firewall nat disable [find comment~\"if master\"] " \
on-master="/ip firewall nat enable [find comment~\"if master\"] "
(In theory you should be able to use pref-src= on an IP route but that doesn't work for a /32 VRRP address for some unknown reasons... but even if it did...you need a script on the VRRP interface to change routing if not master.)
Something to consider is you
might be able to use VRRP connection tracking sync... In that case, you'd need a route to the "brother" router's WAN IP with a higher distance= and disable the /ip/route to the WAN gateway on the /29 in the VRRP on-backup/on-master script as well (e.g. so WAN traffic flows out the router that's the VRRP WAN master, thus connections sync'ed will continue to work. But like to understand the use case before getting the more complex connection syncing...
Also if you're doing VRRP on WAN, you likely should also do on the LAN/VLAN side, so that they can actually take advantage of the multiple routers.