difficult to say.
Can you post the routing tables (show ip route) and the configuration ( to have something more compact you can use “show configuration commands”)?
Are you saying that you left the static routes on the VMs but not on the Vyos? The Vyos will route traffic cross its subnets by default you don’t need to add any routes to it. If you want to block this then you can setup zone polices and apply firewall rules to each policy.
If you have removed the static routes from the VM’s and you can still ping, then sounds like maybe you need to flush the ARP table.