Prisma Acess Agent EPM issue

[GabrielBryson]

I have a PAA agent installed onto a Windows machine and when the vpn tunnel is down the EPM status is up and working but as soon as we bring the vpn tunnel up the EPM status goes down indicating a SSL handshake failed, now ive eliminated DNS issue with/without tunnel, all good, ive disabled dencryption of any *.gpcoudservice.com traffic within prisma, and also done testing with the forwarding profile to ensure  *.gpcoudservice.com also goes direct and not down VPN tunnel from agent. One thing to note according to the documentation, and on other customers deployments the PAA domain should be <company-name>.epm.gpcloudservice.com, now for my tenant the domain suffix is .lab.gpcloudservice and not .epm, this is a demo tenant so not sure if this is correct.  Has anybody seen this before

Thanks