Where to find VNC access logs with IP addresses on Sierra?
Beginning with macOS Sierra, there is a new unified logging system, which requires a bit more work to access than the old system.log, but includes far more details.
Use this command to show the last three days of access logs:
log show --last 3d --predicate 'processImagePath CONTAINS "screensharingd" AND eventMessage CONTAINS "Authentication"'
This will show timestamps, IP, username, and authentication failure/success for both VNC and Apple Screen Sharing connections.