Both my 4S & my wifes 5 say "VPN" on it for Virtual Private Network. We didn't do anything to make it appear; at least not to our knowledge. We don't really know what it does or if is good or bad.
That's certainly odd... The VPN is something that (as far as I know) has to be specifically enabled, and configured. It's not something that should turn on by itself.
You can always go in and disable it (it's under General -> VPN). It's theoretically possible that your data is being routed through a third-party server (masquerading as a virtual private network switch) and sniffed, but I don't see how that could have been enabled remotely without someone physically accessing (and configuring) your phone, so it's unlikely.