The answer is, "It depends."

1) Do you have the routers configured to have a site-to-site tunnel? If so, the clients are not involved at all. This means that the data that flows across the internet is encrypted but when it dumps into the WAN/LAN on either end it is in the clear unless there are other mechanisms protecting the data external from the VPN tunnel.

2) Are you using point-to-point tunnels? This is typically associated with VPN client software on your clients and also the target host. Obviously in this mode of operation, the data is protected the entire path. In this case, the client is involved.

--TH13