Windows DNS times out when connected to VPN

Depending upon which VPN software you are using you should be able to specify which DNS servers that the clients receive when they are allocated their VPN IP address when they connect. This assumes that you are using a full tunnelling VPN and not a SSL VPN or similar.

From memory I think some of the SSL VPNs allow for mapping or proxying of internal to external addresses through the SSL VPN connection.

This behavior is expected given your configuration. You shouldn't have the router's IP set as the secondary DNS for PCs and member servers or they'll always sometimes go there which you don't want. They should only have domain controllers as their DNS so all of their DNS traffic routes through the domain controller. You can then either configure your domain controller to forward to an upstream DNS server for domains it can't resolve (usually this would be your ISP) or just leave it alone and it will use the root hints servers to resolve external queries.

Typically you would want two DNS servers on the PCs and member servers and you would get that by having a second domain controller so DNS (and Active Directory) continue to function if the primary goes down.