I don't know but if 192.168.10.0/24 is your (primary) LAN & not your guest network, you've set it to never use the VPN. 192.168.8.0/24 is the default primary LAN, 192.168.9.0/24 is the guest. That's just a FYI for others reading along.
What I might recommend is putting some IP checking domains into a white/blacklist, one per ea. VPN policy, so you can confirm everything is as expected when checking from client devices. Here's some popular ones:
If you think you've got everything set up as you want don't forget to mark the 'Solution' to let others know.