> * your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details.* Yep, and you can learn a lot about what your users are doing

> * your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details.* Yep, and you can learn a lot about what your users are doing by capturing Netflow data from the (router|switch) the VPN server is connected to. I've never tried but I imagine that with enough data (traffic) in your dataset, it might even be possible to get a pretty good idea of which (de/un)encrypted traffic flows correspond to which users.