Ok - raise a Support case with Microsoft directly - it looks like they may need to delete it on the backend.
"The new VNET integration feature (Regional Vnet Integration) must set locks on subnets in the Network Resource Provider, we set these locks by putting a structure called a Service Association Link onto the Subnet, which is a privileged operation that only Microsoft.Web and some other internal Azure services have access to, this ends up being odd cases where these locks don't get cleaned up."