The point of the VPN is to secure the traffic so it can't be snooped on. As long as each server only allows connections from each other and they're locked down properly, there shouldn't be a problem. Also be sure that there's authentication in place for the database. If something gets through the firewall somehow and tries to connect, you don't want to just let them in.
However, if you don't trust the connection from your prod machine to the VPN, or the VPN to the SQL server, you might want to encrypt it (but at that point you might as well run the VPN on the client and on the SQL server). Don't forget that encrypting it twice will add overhead, and this probably isn't something you want, especially after having to communicate with a database that's off site.
This being said, you'll probably want to go with what the security team recommends. They may have other concerns and without talking to them, we won't know what those might be.