Interesting, I have updated the firmware and only left TLS 1.2 ticked but the Security metrics PCI scan is still complaining that I am using TLS 1.0. How can that be?

Could there be other devices behind the DrayTek router that are responding to HTTPS on a different port / service?
Also was the router restarted after making changes to the TLS settings?

No, the Virgin Superhub is in front of it but the PCI scan is getting to the Draytek's login page. I haven't yet rebooted as it didn't tell me to after I unslected everything but I shall give that a go, re-scan, and report back.

OK, rebooting worked, scan doesn't complain about TLS anymore!