I read this post years back as we did a big migration to Bazel for Android and iOS at Lyft, but was reminded of it from a recent HN comment by jmmv, the author:
And then, almost by chance, I stumbled upon this QoS system, did a few spot-checks, and found that the VPN daemon was misconfigured to run at a low class. Consequently, Bazel starved the VPN for those users and made everything misbehave. Adjusting that one parameter fixed everything.