The point of that tunnel may be to prevent entities that are inside the VPN from sniffing cleartext RDP traffic. If an attacker gets VPN access you want to limit their ability to do damage inside the VPN.