FortiClient IPsec Split Tunnel - Why are two default routes (0.0.0.0/0) installed on Windows?

Hi Team,
We are using FortiClient EMS-managed IPsec Remote Access VPN (IKEv2) with split tunneling.
Our FortiGate Phase 1 is configured with:
mode-cfg enable
ipv4-split-include containing only RFC1918 networks
No full-tunnel configuration
After connecting, the Windows routing table shows two default routes:

0.0.0.0/0 -> 192.168.1.1   Metric 40   (Local Gateway)
0.0.0.0/0 -> 10.68.1.14    Metric 9001 (VPN Gateway)

The local gateway has the lower metric, so Internet traffic should continue to use the local ISP, which appears to be working correctly.
However, we occasionally observe some Internet-bound traffic in the FortiGate traffic logs from VPN users, even though only RFC1918 routes are configured in the split tunnel.
My questions are:
Yes, this is expected behavior. FortiClient installs a secondary default route with a very high metric as part of its standard IKEv2/IPsec split tunneling implementation. This route acts as a fallback or "trap" route and does not override the primary local gateway route due to its higher metric.
Yes, this route is internally used by FortiClient and is part of its design. Even in split-tunnel mode, it may install this high-metric default route in addition to the RFC1918 routes.
Internet traffic may still traverse the VPN under certain conditions, such as DNS-based traffic redirection, Windows Smart Multi-Homed Name Resolution behavior, or applications that bypass standard system routing. These scenarios can lead to DNS leakage or inconsistent resolution. Additionally, IPv6 traffic is not governed by ipv4-split-include, which can also contribute to unexpected routing behavior.
While this behavior is known and observed in practice, detailed official documentation specifically explaining this routing mechanism in IPsec Mode Configuration is limited.