You already said the COR is the same on the VDN as on the station so there goes the most common reason.
VDN/Vectors typically route calls from the same location as PROCR, usually using the ARS analysis location ALL table. Your station may be using a specific location ARS Analysis to route the call.
If you have Tenant Partitioning, check the Tenant of the VDN compared to your station. That may cause the VDN to use a different route pattern with a different FRL.
This one is obvious but check the number in the "route to" step and make sure it is exactly the same as what you dial, including the ARS access code. If you dial "9 1 234 567 8910" then that needs to be in the route to statement. Transposed numbers can be tricky to spot.
I would expect more information from your trace than just the denial event that will point you in the right direction.