And not just "against policy but unenforced and whatever" - for most large orgs I've been with, it's a serious, "conditions of employment" issue. There ARE innocent usages of personal VPN on work computer, but the risk and impact of the nefarious ones massively outweighs them.