By default Essential Security (previously known as Web Safe) is on.
Does the nslookup command show the same result for the VPN site? For example, following returns different IP Addresses for Proton's VPN site:
nslookup protonvpn.com
Server: 192.168.71.1
Address: 192.168.71.1#53
Non-authoritative answer:
Name: protonvpn.com
Address: 81.99.162.48
Name: protonvpn.com
Address: 2a02:8801:200:1::1
and:
nslookup protonvpn.com 9.9.9.9
Server: 9.9.9.9
Address: 9.9.9.9#53
Non-authoritative answer:
Name: protonvpn.com
Address: 185.159.159.140
The latter is correct and the former is result of Essential Security blocking access.