pbr was beyond my bandwidth and willingness. Switched VPNs and it now works fine.

what would be great is an easy way to route device groups or profiles to chosen VPNs. no time to figure that out.