Great question.  According to the documentation, "Internet - Matches all Internet traffic (traffic that does not match an SD-WAN Route) to the destination"  Basically, if VCE has no route in the table and VCO doesn't have a route, it's an Internet destination.  This has a lot of issues with me because it's not a hard and fast rule.