How does ARD find your client Mac over the internet? and security compared to VPN...

I'm just being curious... how does ARD find my client Mac to connect? does Apple keep track of all ip addresses with ARDAgent installed? iCloud? How does this thing work?

Also, is ARD 3.9 secure enough that I don't need a VPN? Do many use a VPN w/ ARD?

thanks in advance.