I think I have a better handle on why IPSec and DHCP supplied red interfaces fail.
What I think is happening is something is blocking DHCP requests and responses when IPSec is enabled. dhcpcd keeps trying to renew the lease and then when it fails, turns off the red interface which also turns off IPSec and open VPN that is able to get a new lease, turns on the red interface which automatically restarts IPSec and open VPN.
I’ll have some time in a couple of days to run tcpdump and collect data for Wireshark to confirm this but in the meantime, does this description trigger anything in anyone’s memory?