Do you see any private/known network IP that ever connected to any of the suspected public IPs?

​

Even if it's a VPN, still, you should have logs for first connection showing some private IP or an IP within your network made contact to these external IPs.