I was under the impression it was left on, not that they turned it on. Does anyone know?
Well, if that is the procedure then they need to somehow transfer the computer into evidence in some sort of Faraday cage to isolate it from any electro-magnetic signals (WiFi) until they can disable the WiFi radio.
If it was on while they were transporting it, he could have accessed it after it was seized while it was being transported to CPD. Maybe attempts to wipe it remotely spoiled the NTFS meta-data on the files. Thus the files weren't deleted, but they look tampered with.
Citrix allows you to access a computer remotely via any web browser with no VPN software on the client computer. He could have gone to the library and opened a browser and logged into another machine at work and then accessed his laptop from that machine over the VPN. But there should be logs on the Citrix server (if they have one) and the VPN router at Cisco to indicate that type of access took place.