FortiGate IPSec Dialup Issues / Multiple WAN and Asymmetric Routing

Hey everyone, hoping someone has run into this before because it's driving me crazy.

Setup: Remote site FortiGate with two WAN links (wan1 and wan2), each with a separate IPsec tunnel (VPN1 and VPN2) connecting back to a data center. The data center side has a single WAN interface. Tunnels are configured as dialup on the hub/data center side because the remote site has dynamic IPs on both WANs.

VPN1 on wan1 is the primary. VPN2 on wan2 is the backup. Static routes are configured with different distances so VPN1 is always preferred.

The problem: When the tunnels first come up (after a reboot, or after clearing SAs), everything works perfectly. Traffic flows symmetrically through VPN1 as expected. This can last a week or even longer with no issues.

Then at some random point, traffic becomes asymmetric. I'll notice the traffic counters on VPN2 start incrementing heavily on one direction — usually incoming data. Outbound traffic from the remote site is still going out VPN1 correctly based on the routing table, but return traffic from the data center is coming back down VPN2.

I suspect the issue originates from the data center/hub side — it seems like the hub starts sending return traffic down the wrong tunnel at some point. But I don't have solid evidence of that yet, just the traffic counters showing the imbalance.

As a side note, everything works just fine, even failover then the primary goes down. It's very quick with this setup but something over time just causes a major issue.

Relevant config snippets:

Tunnel interfaces:

edit "VPN1"
set vdom "root"
set type tunnel
set snmp-index 17
set interface "wan1"
next

edit "VPN2"
set vdom "root"
set type tunnel
set snmp-index 24
set interface "wan2"
next

Phase 1:

edit "VPN1"
set interface "wan1"
set ike-version 2
set peertype any
set net-device disable
set proposal aes256-sha512
set localid "LocationA"
set dpd on-idle
set npu-offload disable
set dhgrp 20
set network-overlay enable
set network-id 1
set remote-gw 1.1.1.1
set psksecret ENC ****
set dpd-retryinterval 3
next

edit "VPN2"
set interface "wan2"
set ike-version 2
set peertype any
set net-device disable
set proposal aes256-sha512
set localid "LocationA"
set dpd on-idle
set npu-offload disable
set dhgrp 20
set network-overlay enable
set network-id 1
set remote-gw 1.1.1.1
set psksecret ENC ****
set dpd-retryinterval 3
next

edit 3
set interface "wan1"
set zone "UNDERLAY-INET1"
set priority 10
set comment "Mapping to INET through ISP1"
next
edit 4
set interface "wan2"
set zone "UNDERLAY-INET2"
set priority 100
set comment "Mapping to INET through ISP2"
next
edit 6
set interface "VPN2"
set zone "OVERLAY-HUB2"
set cost 10
set priority 100
next
edit 7
set interface "VPN1"
set zone "OVERLAY-HUB2"
next