Two on-prem routers each have a VPN to GCP through a single Cloud Router; all traffic flows over one VPN and one BGP session fails. What is the most likely cause?

The most likely cause is an incorrectly configured VPN session. When two on-prem routers each have a VPN to a single Cloud Router, and traffic flows over only one, it indicates an issue with the other connection. If a BGP session fails, it directly points to a problem with the underlying VPN tunnel or its configuration, preventing BGP from establishing. A firewall blocking traffic across the second VPN connection is less likely to be the most direct cause of a BGP session failure, as the VPN tunnel itself would likely show a Down state before BGP could even attempt to establish. A load balancer is not required for basic VPN connectivity and BGP session establishment. While it's true that BGP sessions are not established between both on-premises routers and the Cloud Router (as stated in the problem), this is the effect of the problem, not the root cause. The incorrect VPN configuration is the underlying reason BGP cannot establish.