In the syslog I quite often see the IPSEC VPN being up for some hours during the night.

The IPs are just the legit ones, it seems.

It could be some process which brings up the remote desktop or tries to access some shared printer, etc...

Is there any way to debug this behaviour?

The "Connection" tab of Draytek's SYSLOG client sometimes has a ">>>Dial-up triggered by " entry that details this. Sometimes, but not always

Hmmm, hard to catch this since this guy is doing it at night and by the time I see it, the Connection log has run off the capacity of the logfile.

I am using the Draytek syslog app.

Perhaps a different syslog app would not have such a low logging limit. Is there another app which is recommended for this purpose?

If you click the "Floppy Disk" icon in the top left, you can export the last 7 day's entries to a text file. The "Connection" tab contents appear to be the first thing written to the log. (You're probably supposed to use the "Log Viewer" (next icon along), to view this file)

The Draytek utility can also log to disk in real-time - but it's a long time since I played with that, and can't remember the details of how it works.