E7212PC Connected to an EAP 650 offering a few SSIDs via vlan tagging.  DHCP server configured for each VLAN.  SSID named trusted is for trusted devices, SSID named untrusted is for untrusted devices (IoT etc).

This morning Trusted SSID is working fine, Untrused SSID is not.  Clients get an ip address, but cannot access internet.  Use linux client to connect to Trusted and get IP and this route:

ip route show
default via 10.10.10.1 dev wlp5s0 proto dhcp src 10.10.10.4 metric 600 
10.10.10.0/27 dev wlp5s0 proto kernel scope link src 10.10.10.4 metric 600 

Connect to untrusted (cannot access internet or ping default gateway) - get an ip address and this:

ip route show
default via 10.10.20.1 dev wlp5s0 proto dhcp src 10.10.20.23 metric 20600 
10.10.20.0/25 dev wlp5s0 proto kernel scope link src 10.10.20.23 metric 600 

Manually alter IP config on client whilst on untrusted to use same range but specify details myself, works straight away.  Looks like information from DHCP ER7212PC?  Any advice please?