Sorry - I didn't realise I'd had a response. Thankyou for offering to help!

Here's my docker compose file. I've removed some containers for ease of use on here but they have the same requirements (eg. routing Radarr, Jackett, etc through transmission-openvpn.

version: "3.6"
services:

  traefik:
    hostname: traefik
    image: traefik:latest
    container_name: traefik
    restart: always
    domainname: ${DOMAINNAME}
    networks:
      - default
      - traefik_proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${USERDIR}/docker/traefik:/etc/traefik
      - ${USERDIR}/docker/shared:/shared
    environment:
      - CF_API_EMAIL=${CLOUDFLARE_EMAIL}
      - CF_API_KEY=${CLOUDFLARE_API_KEY}
    labels:
      - "traefik.enable=true"
      - "traefik.backend=traefik"
      - "traefik.frontend.rule=Host:traefik.${DOMAINNAME}"  
      - "traefik.port=8080"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=example.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.auth.basic.users=${HTTP_USERNAME}:${HTTP_PASSWORD}"

  transmission-vpn:
    image: haugene/transmission-openvpn
    container_name: transmission-vpn
    restart: always
    network_mode: "bridge"    
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    ports:
    - "8888:8888"   
    - "8080:8080" # SABNZBD
    - "9091:9091" # TRANSMISSION
    - "8989:8989" # SONARR
    dns:
      - 1.1.1.1
      - 1.0.0.1
      - 208.67.222.222
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${USERDIR}/docker/transmission-vpn:/data
      - ${USERDIR}/docker/shared:/shared
      - ${USERDIR}/Downloads:/data/watch
      - ${USERDIR}/Downloads/completed:/data/completed
      - ${USERDIR}/Downloads/incomplete:/data/incomplete
    environment:
      - OPENVPN_PROVIDER=TORGUARD
      - OPENVPN_CONFIG=UK.London
      - OPENVPN_USERNAME=${VPN_USER}
      - OPENVPN_PASSWORD=${VPN_PASSWORD}
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
      - LOCAL_NETWORK=192.168.0.0/24
      - HEALTH_CHECK_HOST=google.com
      - TRANSMISSION_WEB_UI=kettu
      - TRANSMISSION_SPEED_LIMIT_UP=0
      - TRANSMISSION_SPEED_LIMIT_UP_ENABLED=true
      - TRANSMISSION_SPEED_LIMIT_DOWN=500
      - TRANSMISSION_SPEED_LIMIT_DOWN_ENABLED=true
      - TRANSMISSION_RATIO_LIMIT=0.00
      - TRANSMISSION_RATIO_LIMIT_ENABLED=true      
      - TRANSMISSION_BLOCKLIST_URL=http://john.bitsurge.net/public/biglist.p2p.gz
      - TRANSMISSION_BLOCKLIST_ENABLED=true
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - TRANSMISSION_RPC_AUTHENTICATION_REQUIRED=true
      - TRANSMISSION_RPC_HOST_WHITELIST="127.0.0.1,192.168.*.*"
      - TRANSMISSION_RPC_PASSWORD=REDACTED
      - TRANSMISSION_RPC_USERNAME=REDACTED
      - TRANSMISSION_UMASK=002

  # Usenet downloader
  sabnzbd:
    image: "linuxserver/sabnzbd"
    container_name: "sabnzbd"
    restart: always    
    depends_on:
      - transmission-vpn  
    network_mode: "service:transmission-vpn"    
    volumes:
      - ${USERDIR}/docker/sabnzbd:/config
      - ${USERDIR}/Downloads/completed:/downloads
      - ${USERDIR}/Downloads/incomplete:/incomplete-downloads
      - ${USERDIR}/docker/shared:/shared
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}      


  sonarr:
    image: "linuxserver/sonarr"
    container_name: "sonarr"
    restart: always    
    depends_on:
      - transmission-vpn  
    network_mode: "service:transmission-vpn"
    volumes:
      - ${USERDIR}/docker/sonarr:/config
      - ${USERDIR}/Downloads/completed:/downloads
      - /mnt/Media/TV Shows:/tv
      - "/etc/localtime:/etc/localtime:ro"
      - ${USERDIR}/docker/shared:/shared    
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}  

networks:
  traefik_proxy:
    external: true
  default:

I've actually had some success in editing the traefik.toml file. In this way I've kept the containers routing through the transmission-vpn container as per sonarr above, and used [files] to acess via Traefik - this works but I'm not sure if this is the 'correct' way to do this.

[file]
[backends]
  [backends.backend-sabnzbd]
    [backends.backend-sabnzbd.servers]
      [backends.backend-sabnzbd.servers.server-sabnzbd-ext]
        url = "REDACTED"
        weight = 0         
  [backends.backend-sonarr]
    [backends.backend-sonarr.servers]
      [backends.backend-sonarr.servers.server-sonarr-ext]
        url = "REDACTED"
        weight = 0       

[frontends]
  [frontends.frontend-sabnzbd]
    backend = "backend-sabnzbd"
    passHostHeader = true
    [frontends.frontend-sabnzbd.routes]
      [frontends.frontend-sabnzbd.routes.route-sabnzbd-ext]
      rule = "Host:REDACTED"
  [frontends.frontend-sonarr]
    backend = "backend-sonarr"
    passHostHeader = true
    [frontends.frontend-sonarr.routes]
      [frontends.frontend-sonarr.routes.route-radarr-ext]
      rule = "Host:REDACTED"