For the record, and thanks to @slobera for the help. Essentially Sangoma’s customer support VPN uses the same subnet as my phones (10.200.xx.yy) and therefore when the tunnel was up, Sangoma’s routes trampled on mine and the PBXs response to the phone was going out the wrong end and into the void.
Once we disconnected the tunnel and verified the routes were cleaned up, the phones started registering without issue.