After some sleep, I decided to look at it again. I’ve added RAATServer.exe and https://roonlabs.net to the exceptions under split tunnelling in my VPN, and it seems to be working.
For the moment, I’ll leave this open; if Roon remains stable over the next day or so, I’ll mark it as resolved.