Student owned devices so not enrolled in GAFE.
SSID password changed.
I hard reset all student owned Chromebooks and connected them to our WiFi.
In the google console, made it a “per user” setting and added the new password to automatically connect.
Now students can log into their school issued account but the moment they log into personal accounts the WiFi cuts out.
Worked well for a week 
Now students are logging onto personal Google accounts and connecting to VPN extensions installed whilst at home. The moment they connect to VPN their school WiFi access is restored!
Is there any way I can block VPN access on their Chromebooks?