Thanks to crazy-max:
https://github.com/crazy-max/WindowsSpyBlocker

Windows Update & Windows Telemetry IP address lists //

Reroute Windows Updates via VPN
/ip firewall mangle
add action=mark-connection chain=prerouting dst-address-list=windows_update new-connection-mark=\
c_windows_update passthrough=yes
add action=mark-packet chain=prerouting connection-mark=c_windows_update \
new-packet-mark=p_windows_update passthrough=yes
add action=mark-routing chain=prerouting new-routing-mark=VPN packet-mark=p_windows_update passthrough=no

 /ip route

add distance=1 gateway=<your-vpn-gateway> routing-mark=VPN