FWIW, I upgraded PMS to 1.22.2.4256, and whether in conjunction with my static routes (inspired by guidance from this post) or independent of them, the “Match…” functionality now works!
I have service order priority as follows:
- tun0 (Synology’s connection to my VPN)
- eth0 (connection to my directly-connected-to-my-ISP router, which forwards port 32400 for Plex to my static LAN IP)
- eth1 (connection to a different router that creates a LAN that’s behind the router’s VPN connection)
I created static routes for IP addresses I discovered by digging the following hostnames:
movieagent.plex.tvmediaverse.plex.tvmetadata-static.plex.tvmeta.plex.tv
I also added these, not that I was having a problem, and I didn’t expect they would be related, but why the hell not? 
notifications.plex.tvtvdb2.plex.tvtvthemes.plexapp.complexapp.comdl.opensubtitles.orgopensubtitles.org