The output of route print showed two sets of 0.0.0.0 default gateways.
This happened because Apple's iTunes was previously installed. Even though it had been removed a long time ago, the issue remained.
See The Bonjour service set the Default Gateway to 0.0.0.0.
Microsoft says
This problem occurs because Bonjour uses logic to add a route to
specify a default gateway of 0.0.0.0 which it does not remove.
The following events must happen to receive this route, on a computer
running Windows Vista or higher, with Bonjour installed:
The computer does not receive an address through DHCP prior to the
Bonjour service start.
Under this condition, the Bonjour service adds a default route to the
computer indicating that all internet hosts are “onlink”.
The computer is subsequently able to receive an address through DHCP.
Bonjour does not remove the default route, leaving an incorrect
default gateway configured on the machine. This gateway usurps the
proper gateway configuration DHCP provides and prevents internet
access.
Running the Microsoft FixIt and recreating the VPN fixed the issue.