Even though a user connects via VPN and creates 4776, 4648, 4624 and 4634 event ID's on domain controller, in active directory users attributes lastlogon and lastlogontimestamp still remains null or not set. This user actually does not logon because it cannot pass 2 factor authenticaion in VPN authenticatitor but I just can't understand why those successful logon events are logged in domain controller. Which event id's update these values? Thanks.
These values are not updated by VPN access. They are updated by local logon to a domain machine.
lastlogon is specific to a DC and not replicated via AD. lastlogontimestamp is replicated but it is only updated if it is over 14 days old (it is intended to find obsolete AD accounts).
You could use a log file parser to interpret the logs on all your domain controllers.