There is no "definition" of what logging in terms of a VPN covers or not covers. There might only be an expectation based on whatever information (like marketing), but expectation is not definition. VyPrVPN itself offers a more detailed explanation itself what they mean. From Our Commitment to Our Users:
... we don't track or retain any user activity while connected to our service
So, this is about user activity. And it is about the activity while connected. This can be read as the information of when a user connects and disconnects are not covered by this, since this is not while being connected.
The linked audit provides another perspective right at the very beginning in their Executive Summary:
... no Personally-Identifiable Information (PII) about customers with respect to
their use of the service are logged by Golden Frog except as required for business operations.
... Connections are logged during authentication, but logs that could identify users are kept
only for a short time
Accounting the use of the service at this level might be considered as required for business operations, i.e. tracking the use and potential abuse at a very broad level.
But I agree that their marketing of "We don’t log data" might lead to the wrong expectations. And this might even be intended. But, data (traffic) is not the same as meta data (login, logout, ...).
In other words: when in doubt what some phrase actual means, just consider that it does not mean much by itself and that one should use additional information to find out the details. While not always true at least in this case these detailed information are also easy to find and access. And also: don't believe marketing too much. They might not lie but they likely don't give comprehensive information either and might even hide relevant details in order to look better.
