I got a laptop from university and my account is on their corporate domain, so I log in with my university credentials. The anti-virus is Sophos Endpoint Security and Control and was installed by the IT department. I recently saw that there's a feature called "Web Control" which is enabled. I can't disable this as my "Current user rights" are set to "Sophos user", so I guess this is part of a server and managed directly by IT, rather than being a standalone anti-virus. I'm using MullvadVPN, and wondered, whether IT can monitor all my traffic through this "Web control", or would they just see connections to Mullvad servers?
Yes, Web Control doesn't care whether you're using a direct connection, a VPN, or a proxy server. If you want to do something and you're worried about your university seeing logs, then you better use a personal computer. You can pretty safely assume that everything you do on their laptop is available for them to scrutinize.