In your VPC is a default route table. The instructions on that page don't mention it but if you don't assign a specific route table to a subnet the default is used. In your case, the default route table has a route to the Internet Gateway.
To fix this, create a new route table in your VPC and assign it to the private subnets.
Communication between two private ec2 instancesasked 5 months ago
How to configure subnets for an ECS cluster so it can access a database in the same VPC?asked 8 months ago
Is it possible to create RDS replica in public subnet while master db is in private?asked 5 months ago
How can Ec2 Instance in private subnet access internet via vpc endpoint?Accepted Answerasked 5 months ago
Does Image Builder support build and test an image in a private VPC subnet without internet access?Accepted Answerasked 9 months ago
Placing a Bastion in a Private Isolated Subnetasked 10 months ago
How Instances in Private subnet can connect to Internet with NAT InstanceAccepted Answerasked 4 months ago
How to create a no-internet access (private) subnet?Accepted Answerasked 15 days ago
VPC - Public/Private Subnets - Unable to access from internetasked 4 years ago
Global Accelerator, NLB and Private SubnetsAccepted AnswerEXPERTasked 2 years ago