Not really, no.
First, some terms. You mention ARP spoofing; this is not something you can detect at the IP level. ARP is what tells you which MAC address to address your frames to in order to send them to a given IP; ARP spoofing means you think you're sending them to the right IP, but your device addresses them to the attacker at the MAC layer. This can, however, be detected by software that monitors ARP traffic (by paying attention to ARP updates, and noticing when someone sends one that seems to conflict with a previous update).
The defense to a MitM attack on a TLS-based VPN is certificates (others use shared secrets). Someone with a forged certificate has gone well beyond the "done their homework" stage, into the "this is a serious attacker with serious capabilities" stage. Relying on things that aren't designed to stop a MitM in any way and are easily replicable (like an RFC 1918 address, or the list of open ports) is not likely to work. If the bad guy has the capabilities your question implies, they can just forward all packets on to the router unchanged except for those they want to mess with. You can't detect this, except by checking the public key of the VPN certificate against a known-good value, or by detecting the ARP spoofing in the first place.
There are other things an attacker could do; for instance, they could set up a rogue AP connected to the real one. This doesn't involve ARP spoofing, and can't be detected at the IP layer. It's not all that difficult.
Basically: There are ways to do an MitM attack. To prevent that, certificates were invented; the point of a certificate on a VPN is to prevent MitM attacks. You're asking how to avoid an MitM while assuming the thing designed for that exact purpose has been compromised.