I can see some traffic going from my VPN IP to some other public IPs. It appears the interface vtun0 is going down after only a small amount of packets are sent:
tcpdump: pcap_loop: The interface went down 26 packets captured 26 packets received by filter 0 packets dropped by kernel
After this I noticed the vtun0 has a different IP address for VPN - I'm guessing it is reconnecting after the interface goes down?