I am going to guess when you are connected to VPN that is an outgoing port, not incoming. When you connect, your router shows that port being open because some port needs to be open in order for VPN to work.
I would not stress on this port being open while you are connected to VPN. Are you blocking ICMP packets on the WAN (internet port)? If so, that will stop 99.9% of anyone scanning IP addresses from even thinking about scanning you to see if port 88 is open, because scanners generally ping an address to see if it responds. If it does not, the scanner moves on and does not continue to try to port scan unless an attacker happens to know that there is a computer at that IP address. You would have to be a very specifically targeted person at this point. The chances of that are very very very small (unless you make a point to piss off people who know a lot about networking). Even if an attacker did know that a computer was at a IP address but blocking ICMP, and they knew port 88 was open, they would have to be able to exploit some vulnerability in the protocol/service to attack you.