When I am not on VPN, where is "how" or "where" is my connection being
refused ?
The corporate firewall. The firewall sees a request to connect to a restricted address (the server) from an unapproved address (your laptop's public IP) and rejects it.
When I am on VPN, my connection is to a corporate VPN server. How does
the "server" understand that the connection was through a VPN and not
through the "laptop"
From the server's point of view, your connection is coming from the inside interface of the VPN (not your laptop). The server just needs to be told to accept connections from the VPN. The VPN then handles proxying the connection from your laptop (outside the firewall) to the server (inside the firewall). You send the VPN packets from your laptop, it accepts the packets and passes them on to the server. Conversely, the server sends packets to the VPN server, which accepts them and sends them on to your laptop.
Are VPN servers load balanced to handle entire to and fro
communication from employee's to servers ?
That depends on what VPN tool is being used, but load balancing can be done using some VPN tools.
where is "how" or "where" is my connection being refused
- No idea, it completely depends on how your your network has been designed.How does the "server" understand that the connection was through a VPN
- Your routing table was probably updated, a virtual network interface was probably added. Your outgoing traffic will leave the computer via the virtual interface and will travel via the virtual network as defined by your route table.