Evidence of turning off VPN

Hi, I have reasonable suspicion that users are disabling the VPN on their iPhones in settings. Is there any evidence in the logs that would support this? I’ve downloaded the CSV and investigated them but can’t find anything other than it appearing that they barely use their phone, when in fact I know there should be many more queries than what actually exist.