I'll answer my own question. Profile needs system scope defined like this. It's at the same level with PayloadContent key. <key>PayloadScope</key> <string>System</string>

Having exactly same issue - cannot install com.apple.webcontent-filter from .mobileconfig file (system throws an error "Profile installation failed." "The ‘VPN Service’ payload could not be installed. The VPN service could not be created." The config is essentially identical to the OP. In the console I get this CPProfileManager.installProfile returning error -319 (The ‘VPN Service’ payload could not be installed. The VPN service could not be created.) CPProfileManager.installProfile for user 'zandrey' returning = -319 (INSTALL FAILED)