Accessing IaaS and on-prem applications in zero trust fashion

We are an enterprise with about 3000 employees. We have recently started moving some of our workloads to public cloud, and as a result of that we are looking at re-architecting our access for our private applications. With our on-premise deployments so far, we had VPN servers in our datacenter, and the users were accessing the private applications using traditional VPN based access. But we have started looking at Zero Trust Network Access, and wanted to architect our access using those principles. Couple of solutions have come up during our investigation. Zscaler Private Access, StrongDM, CloudFlare Access, Duo Access, Banyan Security. Has anyone out there tried any of those, and can tell me what are the differences among these solutions, and why they would prefer one over the other.