TLDR:
Edit the registry entry:
HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\ActiveWebProbeHost
Explanation:
After some investigation, I found the following
https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-overview
The event log shows the probe (that updates the indicator) is failing, the reason given (in the above guide) is:
"... HTTP response 200 is received but doesn’t have the text file connecttest.txt in the response payload, "
I confirmed (using postman) that I do indeed get a 200 response but the payload is diverted to a bosch site.
Has this probe site been hacked?
Anyway, by changing the probe URL as above I fixed this problem