I have now tried it again with a B1300 - exactly the same effect.
B1300 as main node and AR300M as node1. As soon as the main node is logged on to a VPN server via WireGuard, there is no access to the network behind Node1.