Another note: just because you have a VPN running on your phone and have enabled Android's "always on VPN" and "block non-VPN traffic" options doesn't mean that devices connected to the phone hotspot will send their data over the VPN. You need to have it configured on the guest device as well.