So it turns out that Sangoma’s support stuff uses 10.200.xx.yy for something, and when the support VPN is on, they push down a route to this subnet on their end.
So check your routes on the PBX (cli: route -n) and see if this is there:
10.200.0.0 172.16.0.1 255.255.255.0 UG 0 0 0 tun0
If it is, then that would be your problem. Change the SIP server IP (if you can) to something else out side of 10.200.0.0/24 and you should be ok.