graphenediscoverer4 When a GrapheneOS device connects to a Wi-Fi network, it automatically does a connectivity check, by contacting a known web server (either Google's or GrapheneOS's, at your option) and fetching a known page.
If that page is received correctly then the GrapheneOS device believes it is connected to a working network and it goes about its business.
If some random response is received instead of the correct page, the GrapheneOS device intuits that the Wi-Fi network uses a "captive portal", meaning that the Wi-Fi network refuses to let devices contact the actual Internet until a human being using each device interacts with a web page presented by the Wi-Fi network. The GrapheneOS device handles this by generating an alert for the user, which takes the user to that web page to interact with it.
If connectivity checking is disabled, that mechanism is also disabled. If a user connects to a captive-portal Wi-Fi network, all traffic will be captured by the captive portal (hence the name). If the GrapheneOS device is set to use a VPN client, the VPN client's traffic will be captured. It will appear to the user as if the Wi-Fi network is broken, or the VPN client is broken, or the app the user is trying to use over the VPN is broken. The user will need to manually detect the problem, manually turn off the VPN client, and manually try to access some web page, at which point the user will be directed to the captive portal. Then the user can manually re-enable the VPN client. While the VPN client is off, various applications may be leaking information to the captive portal server.
Similarly, if the GrapheneOS system updater tries to contact the GrapheneOS update server from a captive-portal Wi-Fi network, it will receive some garbage instead of what it expects to receive, and may well produce an error message perplexing to the user.