Why does my GlobalProtect split tunnel only work after a hard reload?

First, check that *.google.com is under the domain exclusions, not inclusions, and review the access route settings. Then disconnect and reconnect GlobalProtect so you can test the policy on a fresh connection.

Check the firewall logs during a failed attempt. If the relevant traffic is still arriving through the tunnel, that narrows the problem down to policy application or how the domain is being matched.

What is the actual browser error? Open the network tab in developer tools and compare a failed normal load with the hard reload. Look for the specific requests that fail and their hostnames. A traceroute to the destination may also help show which path traffic takes.

Don't assume every request for that page goes to google.com. Some content may come from other domains, such as gstatic.com. The browser network tab and firewall logs should show whether those requests are failing or still going through the tunnel. Review any additional exclusions before adding them.

DNS caching is worth checking, though the hard reload doesn't prove that's the cause. On a Windows client, try ipconfig /flushdns, then repeat the normal load and compare the DNS results and network requests with the hard reload.