With some extra configuration, Diversion will work over a VPN tunnel. The important part is that all DNS queries must be answered by the local DNS server Dnsmasq.
See the website by @Xentrk with detailed instructions:
Policy Rule Routing on Asuswrt-Merlin Firmware
Last update on 2019-04-08 by thelonelycoder.