I tried deleting “tunnel 1” from one of the site-to-site definitions and output now is correct.
Maybe it is not clear from the conf, I have 2 site-to-site VPNs, one with 2 tunnels (peer 40.x.x.120) defined and one using VTI interface and BGP (peer 52.x.x.226).
BTW, in the “show ipsec sa” output there is the opposite issue… Only one tunnel is shown (output is taken when the configuration had 2 tunnels defined for peer 40.x.x.120):
vyos@vyos:~$ show vpn ipsec sa
Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
peer-52.x.x.226-tunnel-vti up 3m8s 3K/139B 58/3 52.x.x.226 N/A AES_CBC_256/HMAC_SHA1_96
peer-40.x.x.120-tunnel-0 up 3m8s 52K/10K 181/98 40.x.x.120 N/A AES_CBC_256/HMAC_SHA1_96