Hi @tobcon,
I have similar problem with VPN and docker subnets. I have VPN client and docker on my home lab. I have added routes and masquerade on MT and have problems with TCP Retransmission and TCP Dup ACK (similar to you). What have you do to fix this?