you doing over the internet when running payroll? Is payroll just a website that you login to and poke around in?

I'm not going to tell you that a VPN service isn't more secure or that you shouldn't use one, but I'm betting you are either already using one through your work, or you are working through an already secure website. A VPN will improve that security posture, but unless you're doing something either super outdated or weird, it's probably already pretty secure. As long as you don't go accepting or installing weird certificates or proxies from the network you're using. Or letting people plug stuff into your computer.