Although CIS firewall can decide about the routing of encrypted packets (hold/allow/block inbound or outbound traffic), regardless of the transport mechanism used (VPN or other), it does not break encryption intercepting them for inspection of their actual contents, and that is a good thing. See here why: Exciting News: Comodo Internet Security 2024 Beta Now Open for Testing! - #465 by infosec
In addition to the extra safety layer that CIS HIPS can provide as @Citizen_K already wrote, CIS’ powerful containment system automatically prevents malware, even when it is signed, from running (for example trying to intercept traffic for decryption and exfiltration).