iRule to only allow traffic from US, Canada and private networks....

Canada has a country code of 'CA' (see https://www.iso.org/obp/ui/search ) you could add another 'and' like the one for 'US' It might however be easier to maintain if you create a datagroup with the country codes, much like you've done with the IP addresses

for example:

when CLIENT_ACCEPTED {
  if {!([class match [whereis [IP::client_addr] country] equals "country_dg"]) && !([class match [IP::client_addr] equals "private_net"])}{
    reject
  }
}