I don't know if there's a better solution, but manually adding hosts file entries for api.loganalytics.io and api.applicationinsights.azure.com pointing to the same private IP as api.monitor.azure.com allowed me to access Log Analytics and Application Insights from the Azure Portal over the VPN.