@maxandjim Think about the whole picture to understand the issue.
Raspberry Pi is connected to Air. This means port-forwards come through AirVPN and end up on the RPi itself (192.168.4.1/24 actually RPi's IP inside the VPN tunnel). Your RPi is like a router, when it gets an incoming connection, it doesn't know if the outsider wants to talk to the RPi or to someone else who's connected to RPi.
This means you must use iptables to forward a certain port to the device you want to respond. Forgive me I don't know the exact iptables commands, but it's along the lines of:
if destinationPort == (motioneye port)
and destinationIP == RPi VPN tunnel IP (10.x.x.x/32, the subnet it's in is /24)
then: NAT forward packet to IP 192.168.10.100.
I think IPv6 should work and route automatically if not denied by default. In any case, you enter the territory where Wireshark or any other network capture tool is your friend this smiley embodies possibly hours of searching and hair pulling. If it doesn't work, I suggest you open a different thread; incoming connections aren't affected by split-tunneling, only outgoing are.
PS: I hope the above command is correct in principle but if not, you'll have to look towards iptables & NAT reroutes.