The log shows the message is on the tunnel interface HUB1-VPN1 and that a shortcut query is received from 192.2.0.1:500, followed by NAT hole punching. This indicates the device is receiving ADVPN shortcut signaling via its hub tunnel from the hub, which is characteristic of a spoke being instructed/assisted by the hub to establish the shortcut.

First off, the traffic matches the SD-WAN rule with service ID 3. We can see that there is at least one valid route in the FIB, so the SD-WAN rule will be selected.
Next, we see HUB1-VPN2 and HUB1-VPN3 have the same slamap value of 0x1 - therefore, they are equally valid members to choose from, and a tiebreak occurs (since there is no load balancing configured).
Looking at the routes, HUB1-VPN3 has a more SPECIFIC route (i.e. better route) and therefore, it wins the tiebreak.

FortiGate evaluates route lookup in a strict hierarchy where policy-based routing is checked first, since it can override normal routing decisions. Next, SD-WAN rules are evaluated to determine if traffic should be steered through SD-WAN logic. After that, Internet Service Database (ISDB) routes are considered for service-based routing decisions. Finally, dynamic routing protocols such as BGP are used as part of the underlying routing table lookup when no higher-priority policy or SD-WAN decision fully determines the path.

The output shows SD-WAN rules with multiple member sequences (vwl_mbr_seq), indicating load balancing is configured for at least one SD-WAN rule (supporting C).
There is a policy route (id=0) that explicitly matches UDP protocol traffic (protocol=17) destined to
10.22.0.0/24 with a next-hop gateway, confirming D.

Because these two cases are applicable to implicit rule whenever they are met. Policy routes have precedence over SD-WAN rules.