WSSA Agent status shows "Local network already protected by WSS"
WSSA agent is reaching to CTC through a public ip already defined as known location in WSS.
The traffic might be entering a full-tunnel VPN and egress via the VPN and an already protected IP address (from the corporate network).
This is an expected behavior if WSSA is reaching CTC through a known location.
A split tunnel can be used if using VPN with WSSA.