[Question] private aks - kubeapi asymetric routing issue

when i provision a private aks, the kubeapi PE for some reason produces an asymetric routing issue with a UDR subnet.
the aks nodes can reach the kubeapi via vnet route directly, but any ACK from the kubeapi to the nodes gets routed over the default route 0.0.0.0/0 (VA) and the firewall drops that traffic.

as soon as i also route the outgoing traffic from the nodes to kubeapi over the VA, it works.

i could not find anything documented on this, and because the AKS created default kubeapi PE has a dynamic ip associated, i started a workaround creating all my self (kubeapi PE,NIC static ip, A-rec,..) just during the aks provisioning. it basically works this way.

the issue however in this case is that inside the cluster, coredns gets the auto created kubeapi ip set continously in the configmap.

my questions:
1) is there a way to avoid the asymetric routing issue?
2) is it possible to have a static ip set for the auto created kubeapi nic?
3) or possible to make aks controlplane forget about the auto created kubeapi nic ip (not working without routing table update), and use another manually created kubeapi ip?