The license recycling feature only recycles Agent licenses, so what you describe is working as intended. There is a logical reason for this behavior, so maybe that will help explain why.
With the LEM Agent, when an Agent disconnects it sends a "last gasp" to the LEM: "I'm going towards the bright light, I see grandma!" Because of this, LEM can very clearly determine that an Agent has gone off-line, and begin to track how long the Agent has been gone. If the Agent is disconnected for longer than the license requiring threshold, than the LEM deletes that Agent and you reclaim the license.
(If you ever have an Agent get nuked by license recycling and then come back to life, it will not be able to connect: the LEM has invalidated its certificates. You'll see the connection attempts in your Monitor tab or in nDepth as "InternalUnknownAgent" events, and need to reset the certs on the Agent to allow it to connect again)
Syslog nodes are more complicated because they don't send any sort of last gasp. LEM can't tell the difference between "I have received no syslog because the device is demised" and "I have received no syslog because the device has nothing to say." LEM has a blindspot for the syslog nodes because of this and cannot automatically recycle those licenses.
Now, for the VPN connection creating nodes: that's weird. What is your VPN concentrator? It's possible we need to have you submit a connector update request or that the syslog format isn't exactly what we expect.