It's easier to authorize/whitelist than it is restrict, granted. I missed your mention of Multi-WAN. You may have discovered another bug perhaps this time in the routing tables. I'm reposting/linking this because it seems relevant even if you're not use v4.8.0-op24:
I'd take Multi-WAN out of the equation & see if that makes a difference. I would at least hope so.