If you consider that the network between the VPN's endpoint and the OAuth2 server is safe (because request are reencrypted, or it's a "trusted network"), then an HTTPS tunnel or a VPN tunnel offers the same level of security (encryption and authentication).
However, as stated in section 188.8.131.52 of the OAuth2 RFC:
The redirection endpoint SHOULD require the use of TLS as described
in Section 1.6 when the requested response type is "code" or "token",
or when the redirection request will result in the transmission of
sensitive credentials over an open network.
So it's highly recommended to have the OAuth2 server protected with TLS. If it's not, some credentials could be intercepted on the local network of the company in case of misconfiguration of some network equipment.
Also not that OAuth2 expect to have TLS everywhere, so some things can actually not work. For instance, some libraries could refuse to use some endpoints of
/.well-known/openid-configuration if it's not HTTPS.
So: it's highly recommended to enable HTTPS on your OAuth2 server, but in your case it is not mandatory.