We had problems until we rewired the building with more current cabling, you need to have Cat 5 or better. Also run speed tests near the WAP points, typically those away from the router. We did all that and have not had problems, and we now get 4 bars in the RS room where we only got two or three before.
Opening Gospel Library for the first time on a Sunday often initiates content update delivery, I usually do more general updates at home but my ward has an 830am start time so that is sometimes forgotten.
I am surprised though that they have not done more to shut down the VPNs, those are usually filtered under Proxy Avoidance, but there must be another category that Zscaler calls those. One more things about the VPN apps, some have nefarious intentions and so when they find the delivery line is blocked, they find another place to run things the filters have not caught up to yet so one is often stymied in trying to fully block those