Well…
/interface pptp-client
add add-default-route=yes connect-to=vpn.integrity.st default-route-distance=0 …
so you definitely modify the routing table as soon as the VPN session comes up.
default-route-distance=0 is wrong, you should set it to 1 here and to 2 in /ip dhcp-client interface=WAN configuration so that the default route provided by the VPN client would win whenever the VPN is up (or even do something harder if sending something from your actual address rather than the VPN one can cause some trouble), but that’s not the reason why the ssh and winbox services stop responding.
You do have the default route with routing-mark there:
/ip route
add check-gateway=ping distance=1 gateway=WAN routing-mark=eth
But there are no /ip firewall mangle rules which would assign that routing-mark, so that route is never used - I’m actually surprised that your PPTP connection doesn’t get up and fall down cyclically, I guess credits for that go to routing cache which keeps sending the PPTP transport packets via the WAN’s gateway even though the default route changes as the PPTP gets up, but routing cache gets flushed every now and then.
Plus an interface name can be configured as route’s gateway only if the interface is a point-to-point one, so this route would not work.
So have a look at policy routing, e.g. here, and also add an individual route to the VPN server so that the PPTP transport packets don’t eventually get redirected to the PPTP tunnel once the routing cache gets flushed. You can use the script parameter of /ip dhcp-client to host a script which will, after each renewal of DHCP lease, copy the received gateway IP address to that individual route and to the marked default route.