A Cisco Catalyst SD-WAN administrator reports that hosts in service VPN 20 (Guest) at a branch can unexpectedly reach servers in service VPN 10 (Corp) at a data center. Each VPN was designed to be isolated. The administrator confirms both VPNs are configured on the affected devices and BGP is redistributing OMP routes normally. When troubleshooting this east-west leak, which configuration element should the administrator examine FIRST to identify why routes are crossing between the two service VPNs?