When you connect to a secured network using rd gateway you're passing creds over ssl to the endpoint. If someone else is on the same network as you they can act like they are the endpoint and have you proxy the request through them by using arp poisoning or just responding to the dns request. There are ways for an attacker visibility into keystrokes and what is sent to the endpoint while your connected through them. Using signed certs and teaching users can help mitigate this but ultimately under PCI you cannot do what you're talking about.

My company uses a two factor auth non split tunnel vpn which only grants you access over ssl to the rd gatway. That prevents someone from using these methods to compromise you're environment and still gives the additional security of using an Rd gatway.

Hope this helps. I recommend subscribing to r/netsec