I have a similar issue. The is_online flag is not updating. New devices can join the fleet but the state is always offline (or online if the device was online prior to the upgrade mentioned below).
The device logs feed is working fine, and I can open tunnels, but can’t communicate with the devices.
Backstory:
I upgraded from 4.1.251 to 4.1.349 and created a new ssl certificate using certbot. When I do make up, docker ps often show that the vpn service as unhealthy.
The only time I can manage to get the vpn service to become healthy is when the api fail to run migration "0074 and I run the following:
docker exec -it open-balena-api-1 /bin/bash
rm src/migrations/0074-normalize-release-contract.async.ts
exit
docker restart open-balena-api-1
docker restart open-balena-vpn-1
(cred to @pschmo in openBalena 2024 - #7 by pschmo)
And that’s when I encounter the issue of device state not being updated, e.g. is_online never updates. When I upgraded to 4.1.251, I only had to remove the 0074 migration file and restart the services to get up and running. I wonder if this is even related to my issue? 
Maybe I need to dig into what’s happening in the vpn container?
@benjboy did you manage to figure out what caused the issue? 