Because of the assumption that subnets have auto-assign public IPs turned on, which is how CAPA configures the subnets it creates, supplying your own VPC where that is not the case causes the bootstrap node to not get a public IP and therefore not be able to download the release image (no internet connection).

The bootstrap node needs a public IP because the public subnets are connected only to the internet gateway, which does not provide NAT.