If it started happening recently I would look into any potential changes to the VPN profile (xml file).
An admin could have been doing something to the "Automatic VPN Policy" settings (under Preferences Part 2 in the profile editor) that got pushed to the clients, making them think they need to be on VPN even when that is not the case.
I'd compare the profile on a client with the problem with a client that isn't experiencing it.
