- the distance parameter of a route only plays a role when the other matching criteria of several routes (dst-address and routing-mark) are exactly the same. Out of all these routes whose gateway is currently reachable, the one with lowest value of distance becomes active.
- among all active routes whose dst-address matches the destination address of the packet and whose routing-mark matches the packet's one, the one with longest prefix of dst-address is always chosen to route the packet
So what happens when you reboot the machine: first, the WLAN interface goes up, so it gets an IP configuration including a default gateway via DHCP. Once the default route is installed, the LT2P/IPsec gets up, and once the L2TP interface gets up, the IPCP installs another default route via the L2TP tunnel. If you don't remove the default route via WLAN, it probably remains active, so the traffic keeps using it. Once you delete the default route via WLAN, the IPsec transport packet likely keep using its gateway because the routing cache remembers that routing decision, whereas the first packet of each new connection is routed using the route via the L2TP.
What surprises me a lot is that in this state, it keeps working for an unlimited amount of time, because a record in the routing cache normally expires every now and then and the routing has to be repeated. So once this happens, the tunnel should fail in the absence of the route via WLAN.
So a quick and dirty solution is to create a static route with dst-address
matching the IP of the VPN server, and let the L2TP install a dynamic default route.
A slightly more complex but more future-proof solution would be to use policy routing or /ip route vrf
to let the Mikrotik itself use the default route via WLAN, and let the traffic forwarded from the LAN port (where your PC is connected) use the default route via L2TP added into another routing table (i.e. with another routing-mark). The advantage here is that you can use a DNS name of the VPN server instead of its IP number. But in the latter case, do not use Mikrotik's own IP as the PC's DNS server, as the DNS requests would go via the WLAN route directly.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.