Dnsmasq has a neat feature where you can populate ipsets/nftsets with responses to dns queries. So I have it populate a set with the IPs for sites like neverssl.com, and use a firewall rule to route requests to destinations in the set through wan without sending it through the VPN. Usually works.