Im almost 100% sure they are checking to see if the tap/tun adapter is running when you auth on login.
I tested this with my work vpn(we use tunsafe) that does not route lost ark traffic at all.
Tunsafe process running but not connected = Successful login
Tunsafe process running and connected = Blocked
This is why my bypass for logging in with mudfish works. The one i posted on another thread where you reach server selection first before turning mudfish on.
The more recent issue of people dc-ing seems to be triggered by having too many people using the same node. As i posted above i suspect they are manually kicking you if you have incoming traffic from same node as many other people.
Perhaps its possible to reach out to amazon support to see if they will consider whitelisting mudfish IPs? According to exitlag twitter they did that. https://twitter.com/ExitLag/status/1535358278351347713