I ended up running the Windows Edge Client and it was able to intercept the connection and connect to the zrok controller. For some reason the tunneling edge router I had setup as a local gateway on my home network wasn't working properly.
I also rebooted the cloud VPS that has the controller and another tunneling edge router. The services (zac/zrok) failed to be exposed again (no terminators). I then restarted all the containers and it started working.
So here's a question -- if at the time the tunneller edge router comes up it cannot connect to the hosted services, does it just mark them as down and never retry? I think my intermittent failures are a result of the order of initialization of various containers on startup.