WSSA Agent status shows "Local network already protected by Cloud SWG (Formerly known as WSS)"
WSSA agent is reaching to CTC through a public ip already defined as known location in Cloud SWG Portal (formerly known as WSS portal).
The traffic might be entering a full-tunnel VPN and egress via the VPN and an already protected IP address (from the corporate network).
This is an expected behavior if WSSA is reaching CTC through a known location.
A split tunnel can be used if using VPN with WSSA.