Issues getting split-tunnel in client VPN endpoint to work correctly.

I'm setting up a company VPN using AWS Client VPN endpoints, I have everything working so far however all client internet traffic is being routed through the VPN and out through the NAT gateway (and therefore incurring NAT gateway costs). I'm trying to enable split-tunnel however I'm still getting 0.0.0.0/0 routes to the vpn added to my route table.

If I try:

• Split tunnel enabled
• Routes to local vpc and peered networks
• Authorized access to these routes
• Fairly open security group

And then connect to the VPN I still get this in my route table:

> ~/d/i/vpn on branch ◦ netstat -nr                                                                                                          11:03:22
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.0.2.161      0.0.0.0         UG        0 0          0 tun0
0.0.0.0         192.168.4.1     0.0.0.0         UG        0 0          0 enp0s20f0u2
0.0.0.0         192.168.4.1     0.0.0.0         UG        0 0          0 wlp0s20f3
10.0.2.160      0.0.0.0         255.255.255.224 U         0 0          0 tun0
10.10.0.0       10.0.2.161      255.255.0.0     UG        0 0          0 tun0
-------       10.0.2.161      255.255.0.0     UG        0 0          0 tun0

(With some redaction above, I'm using 10.0.0.0/22 as the vpn cidr)

I'm connecting from a Fedora laptop using the built in vpn client, I'm creating a vpn file based off the one you can download and importing it after adding in certs & keys). This all means that when I'm trying to connect to the VPN I can access my private resources, but I lose all general internet connectivity. For our use case it's not workable to us to keep having to hop on and off the VPN.