Let me begin with important note. VPN, a "virtual private network", doesn't say anything about security. Virtual, i.e. there is no additional physical thing. Private, so you can not ask anybody how to design, deploy and for which purpose. Network, so you'll connect something by its means so it looks like ordinary network connection. Where is encryption and authentication comprising security? It is often assumed, but nothing in this acronym requires any of them. And you well can build a VPN without any encryption and authentication, for instance, use raw IPIP or GRE or L2TP v3. And techically that would be a VPN by the definition, but insecure.
Your consideration must begin with question to yourself: which VPN? Is it secure? Is each system that can participate secure too?
If web service is running on the same machine as one VPN endpoint, and also the web client is running on the same machine as other VPN endpoint, and routing is set up such as that the communication between them is possible only through that VPN channel which is properly secured, their communication can be considered secure.
A caveat: in this case there is usually no way for either client or server to assure they are running through secure channel. They only use unencrypted connections themselves, all the encryption is done transparentely for them, without any way to ensure and influence security. If VPN software is buggy and security can be disabled, they may continue to communicate, without noticing and without notifying the user the communication is no longer secure. This is not a joke and not theoretizing, I've seen example of such VPN.
This is why often encryption is embedded into software that usually doen't meant to be communicating over insecure networks, like database engines. To serve as additional layer of security. To be sure that even if something goes wrong, we have some endurance left.
