Theoretically, any software running on your system could monitor socket activity if given the appropriate privileges.
(It's not exactly clear from your question, as it stands, as to what you want an answer to.)I'll assume that you're asking whether a free VPN provider that you use is logging network activity of other applications running on the same host, even when it is not functioning as a VPN.On Android, all (or most) traffic is routed through the VPN software, so when it is installed as a VPN it will see all connection attempts. This is because Android routes all packets through the VPN, up to v10 (? not sure when this changed, please feel free to clarify with edit ?), and since v10 some packets (specifically root) can still flow via the underlying network connection and aren't forced through the VPN. TODO ref.
Other software running under the same context can use host tools such as the /proc/ vfs or ss etal. to poll for open sockets and compile a log of these, viz. NetMonitor. Depending on the default configuration, none, some or all of the sockets you currently have open are visible tovia this interface.
The VPN service provider will often make use of some standard VPN software, such as OpenVPN or WireGuard, but they will also offer a convenience application that will instal and configure everything. Often, you as the user will be able to configure this or at least audit the configuration to ensure that no logging is occurring on your device. From a logical perspective, you must assume that your free VPN provider is logging as much as possible, because there's no way for you (or any of us) to prove the alternate theory. Repeat after me: "there is no such thing as a free VPN". So, the question that you need to consider, in answer to your question: how does your VPN provider cover the costs of providing you with a "free" VPN?
