Ok, I did some debugging and this looks really weird.
First, trying to run NetworkManager --debug manually:

<info>  [1538138381.5570] audit: op="connection-activate" uuid="1a43441b-6b26-4e0c-8343-976afcf790fd" name="DataStax" pid=3717 uid=1001 result="success"
<info>  [1538138381.5755] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: Started the VPN service, PID 8148
<info>  [1538138381.5973] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: Saw the service appear; activating connection
<info>  [1538138381.6059] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: VPN plugin: state changed: starting (3)
<info>  [1538138381.6060] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: VPN connection: (ConnectInteractive) reply received
<info>  [1538138381.6485] manager: (tun0): new Tun device (/org/freedesktop/NetworkManager/Devices/6)
<info>  [1538138381.6586] devices added (path: /sys/devices/virtual/net/tun0, iface: tun0)
<info>  [1538138381.6586] device added (path: /sys/devices/virtual/net/tun0, iface: tun0): no ifupdown configuration found.
<info>  [1538138382.5173] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: VPN connection: (IP4 Config Get) reply received from old-style plugin
<info>  [1538138382.5177] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data: VPN Gateway: 12.111.84.106
<info>  [1538138382.5178] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data: Tunnel Device: "tun0"
<info>  [1538138382.5178] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data: IPv4 configuration:
<info>  [1538138382.5178] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   Internal Address: 10.150.1.247
<info>  [1538138382.5178] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   Internal Prefix: 32
<info>  [1538138382.5178] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   Internal Point-to-Point Address: 10.150.1.247
<info>  [1538138382.5178] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   Static Route: 0.0.0.0/0   Next Hop: 0.0.0.0
<info>  [1538138382.5178] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   Static Route: 10.150.1.247/32   Next Hop: 0.0.0.0
<info>  [1538138382.5179] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   Internal DNS: 10.200.1.10
<info>  [1538138382.5179] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   Internal DNS: 10.200.1.11
<info>  [1538138382.5179] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data:   DNS Domain: 'datastax.lan'
<info>  [1538138382.5179] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: Data: No IPv6 configuration
<info>  [1538138382.5179] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: VPN plugin: state changed: started (4)
<info>  [1538138382.5447] vpn-connection[0x55c2f915e0b0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",7:(tun0)]: VPN connection: (IP Config Get) complete
<info>  [1538138382.5451] device (tun0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external')
<info>  [1538138382.5796] keyfile: add connection in-memory (b59f240b-d74e-4c9f-a5c7-219cdff8374d,"tun0")
<info>  [1538138382.5809] device (tun0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external')
<info>  [1538138382.5819] device (tun0): Activation: starting connection 'tun0' (b59f240b-d74e-4c9f-a5c7-219cdff8374d)
<info>  [1538138382.5824] device (tun0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'external')
<info>  [1538138382.5829] device (tun0): state change: prepare -> config (reason 'none', sys-iface-state: 'external')
<info>  [1538138382.5833] device (tun0): state change: config -> ip-config (reason 'none', sys-iface-state: 'external')
<info>  [1538138382.5840] device (tun0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'external')
<info>  [1538138382.5852] device (tun0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'external')
<info>  [1538138382.5854] device (tun0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'external')
<info>  [1538138382.5913] device (tun0): Activation: successful, device activated.
Naruszenie ochrony pamięci  /// <<<< SIGSEGV (crash)


Then trying to do the same under valgrind:
<info>  [1538138423.6684] audit: op="connection-activate" uuid="1a43441b-6b26-4e0c-8343-976afcf790fd" name="DataStax" pid=3717 uid=1001 result="success"
==9083== 
==9083== HEAP SUMMARY:
==9083==     in use at exit: 1,070,170 bytes in 14,200 blocks
==9083==   total heap usage: 357,423 allocs, 343,223 frees, 22,893,758 bytes allocated
==9083== 
==9083== LEAK SUMMARY:
==9083==    definitely lost: 5,168 bytes in 34 blocks
==9083==    indirectly lost: 3,595 bytes in 41 blocks
==9083==      possibly lost: 2,466 bytes in 30 blocks
==9083==    still reachable: 918,773 bytes in 13,004 blocks
==9083==                       of which reachable via heuristic:
==9083==                         length64           : 2,192 bytes in 44 blocks
==9083==                         newarray           : 1,856 bytes in 36 blocks
==9083==         suppressed: 0 bytes in 0 blocks
==9083== Rerun with --leak-check=full to see details of leaked memory
==9083== 
==9083== For counts of detected and suppressed errors, rerun with: -v
==9083== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
<info>  [1538138423.7732] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: Started the VPN service, PID 9084
<info>  [1538138423.7754] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: Saw the service appear; activating connection
<info>  [1538138423.8811] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: VPN plugin: state changed: starting (3)
<info>  [1538138423.8852] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: VPN connection: (ConnectInteractive) reply received
<info>  [1538138423.9018] manager: (tun0): new Tun device (/org/freedesktop/NetworkManager/Devices/6)
<info>  [1538138423.9322] devices added (path: /sys/devices/virtual/net/tun0, iface: tun0)
<info>  [1538138423.9328] device added (path: /sys/devices/virtual/net/tun0, iface: tun0): no ifupdown configuration found.
<info>  [1538138425.5369] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",0]: VPN connection: (IP4 Config Get) reply received from old-style plugin
<info>  [1538138425.5557] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data: VPN Gateway: 12.111.84.106
<info>  [1538138425.5568] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data: Tunnel Device: "tun0"
<info>  [1538138425.5584] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data: IPv4 configuration:
<info>  [1538138425.5594] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   Internal Address: 10.150.1.248
<info>  [1538138425.5601] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   Internal Prefix: 32
<info>  [1538138425.5609] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   Internal Point-to-Point Address: 10.150.1.248
<info>  [1538138425.5620] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   Static Route: 0.0.0.0/0   Next Hop: 0.0.0.0
<info>  [1538138425.5625] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   Static Route: 10.150.1.248/32   Next Hop: 0.0.0.0
<info>  [1538138425.5634] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   Internal DNS: 10.200.1.10
<info>  [1538138425.5640] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   Internal DNS: 10.200.1.11
<info>  [1538138425.5648] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data:   DNS Domain: 'datastax.lan'
<info>  [1538138425.5657] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: Data: No IPv6 configuration
<info>  [1538138425.5678] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: VPN plugin: state changed: started (4)
<info>  [1538138425.6325] vpn-connection[0xa1b47a0,1a43441b-6b26-4e0c-8343-976afcf790fd,"DataStax",8:(tun0)]: VPN connection: (IP Config Get) complete
<info>  [1538138425.6388] device (tun0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external')
<info>  [1538138425.7763] keyfile: add connection in-memory (536feec9-98d9-443b-aebb-084529bef1a6,"tun0")
<info>  [1538138425.7987] device (tun0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external')
<info>  [1538138425.8178] device (tun0): Activation: starting connection 'tun0' (536feec9-98d9-443b-aebb-084529bef1a6)
<info>  [1538138425.8198] device (tun0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'external')
<info>  [1538138425.8269] device (tun0): state change: prepare -> config (reason 'none', sys-iface-state: 'external')
<info>  [1538138425.8323] device (tun0): state change: config -> ip-config (reason 'none', sys-iface-state: 'external')
<info>  [1538138425.8375] device (tun0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'external')
<info>  [1538138425.8518] device (tun0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'external')
<info>  [1538138425.8557] device (tun0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'external')
<info>  [1538138425.8957] device (tun0): Activation: successful, device activated.  // <<--- the last message
// ... (wait)
// ... (wait)
// ... (wait)
// ???? no further messages, no crash, it works like a charm