As you mention, you should definitely setup "split tunnel" VPN, wherein traffic only traverses the VPN when it needs to -- other traffic goes over the internet. That is likely the simplest solution to your issue. However, the caveat is that these infected computers can still be used as a hop-off point to access resources on your VPN; so you can have a security issue and not be aware with that solution.
There are many other, more complex ways of addressing the problem. Of course, not just advising but requiring VPN users have active, up to date AntiVirus is important. Many VPN concentrators (Cisco, Juniper, etc) have features in their VPN clients that allow for testing for compliance to a host profile -- e.g. see if updates are installed, antivirus is current, etc.
Moving up an order of magnitude, an IPS (Intrusion Prevention System) system is the ideal solution to this problem; if budget allows as these systems are prohibitively expensive and often require significant resources to setup. A properly configured IPS will immediately revoke VPN access if seriously anomalous activity is detected -- a DDOS attack will almost certainly trigger this.
In this case, you can still use a "full tunnel" VPN with all internet traffic using the VPN as the default gateway if you prefer. While speed may suffer on a full tunnel VPN connection, it will be more secure as all traffic will have to traverse the IPS system.