If I understand you scenario properly you have 2 options for south-north:
1) use VRRP instead of active-gateway. Then set the VRRP master for all SVIs on the VSX primary to make sure that the first L3 lookup happens on the VSX primary, resulting to all routed traffic to be attracted on the VSX primary. From here, the traffic would go to DC. It works but the downside is that you have traffic over the ISL including for inter-VLAN routing for traffic that does not go to DC.
2) keep using active-gateway, and rely on the BGP local-preference difference (primary setting higher LP than secondary for the routes received from the DC). In this model, the traffic hitting the VSX secondary, will be routed on the secondary, but to go to the DC, it will use the transit VLAN between secondary to primary instead of using your core link connected to the secondary. The benefit is that inter-vlan traffic is contained inside one of the VSX node without need to go to primary.
Bottom-line, if you have very minimum inter-vlan routing both options are valid. If you have lot of inter-vlan routing (endpoint subnet1 to subnet2), then I would recommend option 2. In all cases, you have to set transit VLAN between VSX nodes for routing continuity (ex: reaching loopback of primary VSX when you loose upink from primary).
In both cases, for return traffic (north-south), you need to play with BGP attributes to advertise routes from VSX secondary with lower preference to DC. There are multiple ways of doing that depending on eBGP versus iBGP being used, AS prepending, community based routing...