Traffic processing BGP Azure VPN gateway A/A

With an active-active VPN gateway, both gateway instances and tunnels can participate in routing, so you should plan for traffic to use either path unless your BGP policy makes one path preferred. The big thing with Azure Firewall or an NVA in the middle is symmetric routing. I would compare effective routes on the VM subnet with the BGP routes learned and advertised by the gateway, then check the on-prem local preference or AS path choices.