Talk about how you think the VPN works because I'm not really sure how the crash happens. Does your son connect to the VPN, attempt a connection, and then it crashes? Do you start the MC server, then the VPN, and it crashes? Do you start the VPN, MC server, and then it crashes?
How's the VPN connection? Can you ping between the two devices? I'm assuming you're both connected to the VPN which means you both should have somewhat similar IP schemes.
Perhaps the split tunnel is doing something to interfere with something? Normally, I would think people push traffic through the tunnel to the outside of the VPN service, not have a server, though that shouldn't change much.
Are there guides or videos of people using Express? And specifically a MC server? Maybe they configured some kind of error that you haven't? Unlikely but still may be worth a shot.
Also a connection refused is odd. At first I thought this was a client crash because of the connection refused but then again, I would have thought a client crash would have a connection timed out because packets are getting lost on the way to the server. But a connection refused on the server is also odd.