My guess would be that when turn on the Express VPN it is setting the default route to be the VPN therefore when request come in on the WAN to NextCloud it is responding out the VPN instead of the WAN. You can use pfTop under “Diagnostics” to track the connected and then make the correction in the policy routing.