It’s a strange case: non-routable public IPs..
Still ZT just have just not used the route if it could not get to a ZT root/etc server & found the default route the router was using (assuming the router could “:ping 1.1.1.1” etc.). Perhaps firewall blocked too here.
So I would have said as a NAT rule for the tunnel to get a “source address”, but you can’t identify the ZT tunnels in the firewall.
But the underlying “issue” is that Mikrotik doesn’t treat the zt1 instance as an interface – only the zerotrier1 network is an interface. To the firewall connection tracking, it’s unnamed local traffic that can’t be identified in the firewall to do anything specific to the ZT tunnels. I ran into similar thing in troubleshoot/understand where the tunnel/ZT1 traffic was going, so I wrote a script that tries that uses /zerotier/peers to figure out where ZT tunnels were going, see http://forum.mikrotik.com/t/zerotier-on-mikrotik-a-rosetta-stone-v7-1-1/155978/18 but it’s not perfect at doing it (e.g. I should fix some bugs in that script one day).