The spoke vnets will need remote Gateway Transit enabled
To use virtual network peerings in the virtual network Peering setup:
- Configure the peering connection in the hub to Allow gateway transit.
- Configure the peering connection in each spoke to Use the remote virtual network's gateway.
- Configure all peering connections to Allow forwarded traffic.
Reference: Hub-spoke network topology in Azure
Make sure ICMP is enabled on the client firewalls, and allowed via the NSGs as well.