When creating new VPNs, now the ONLY Trusted Root CA is defined as "USERTrust ECC Certification Authority". This is in conformance to the official docs at: https://wiki.upv.es/confluence/spaces/MANUALES/pages/903381153/Windows+-+VPN+con+Microsoft+Windows+11
Another "DigiCert Assured ID Root CA" used to also be trusted. This was an old selection, which used to be the main Root CA.
For a while, while transitioning to the new Root CA, both were advised to be selected. Now the older was is no longer mentioned in the docs, so we have removed it from the configuration for future VPNs created with this tool.