Note that you also need to stretch a couple of VLANs between AZ1 and AZ2:

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-A56D8E59-A549-4624-BC61-4A9271...

Between AZ1 and AZ2 to the Witness Site you only need connectivity for Management VLAN (AZ1) and Management VLAN (AZ2), not vSAN since WTS is being used.