Something is injecting a route in Windows route table - but what?

Question

Hi, We have some users that connect to head office via VPN that are noticing a route to a 10.x.x.x/24 subnet that comes and goes and messes up reachability to internal resources while that specific route is in the Windows routing table. I'm 99.9% sure that it nothing to do with the config on the VPN side of things but I don't know how to prove this. I guess I need a Windows log that records a route add event and hopefully tells you what application or process triggered it. Anyone know how I can do this? Many thanks in advance!