Exceptions by policy routing is highlighted; its page is below.

Exceptions by policy routing

The PS5 plays better on a direct path, and guests have no reason to use the VPN. Their internet rules move their packets into the WAN's routing table and tag them, and the WAN rules let only tagged packets through.

How it works#

rtable 1 on the PS5's internet rule makes pf look up the route in the WAN's routing table instead of the internal one.
tag DIRECT marks the packet, so later rules can recognise it.
Only tagged packets are translated to the provider's address, and only tagged packets pass the WAN's kill-switch rules.
pf's state tracking carries the replies back across the two routing domains.

Their DNS goes direct too: DHCP hands them Quad9, and pf lets those lookups out the same way, tagged. So they keep working when the tunnel is down; the trade-off is that they miss the tunnel's ad and tracker blocking.

In the configuration#

/etc/pf.conf

match out on $wan inet tagged DIRECT nat-to ($wan)
pass in log quick on $ps5 inet from $ps5:network to ! <internal_nets> \
    rtable 1 tag DIRECT label "allow_ps5_internet_direct"
pass in log quick on $guest inet from $guest:network to ! <internal_nets> \
    rtable 1 tag DIRECT label "allow_guest_internet_direct"

Two networks are named here, and nowhere else. Every other network keeps the full kill switch.