What are the differences between when the packages run quickly or take a long time
Do you capture any audit data from your packages so you know the number of records extracted, and loaded into the target database (If you do not, then it will be difficult to solve your problem.)
Are there any patterns (only in the morning, only on the 7th Tuesday of a month, that sort of thing) around the problem behavior
In addition to looking at SSIS and the source and destination systems, you should probably also look at the core four resources monitored when performance tuning: Memory, Processor, Network and I/O. If one of these resources was being over-utilized on one of the core machines used by your package, but only sometimes, this could explain y our behavior.
Also, the fact that you're using a VPN and not a LAN connection is what I would probably focus on first. Pulling lots of data over a slow connection can be problematic.