What is the correct syntax to add CFLAGS and LDFLAGS to "configure"?

The correct way is:

./configure CFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib"

but this may not work with all configure scripts. It's probably better to set environment variables such as CPATH and LIBRARY_PATH (see gcc man page).

An example:

export CPATH=/usr/local/include
export LIBRARY_PATH=/usr/local/lib
export LD_LIBRARY_PATH=/usr/local/lib

in your .profile, for instance. The LD_LIBRARY_PATH can be needed in case of shared libraries if a run path is not used (this depends on the OS, the build tools and the options that are used, but it shouldn't hurt).

The first syntax is correct.

./configure CFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib"

However, it is strongly recommended to either use binary packages(7) or, if for whatever reason you absolutely need to build from source, make use of the ports(7) infrastructure, as explained by the FAQ section 15.

Set up the ports tree as detailed in the FAQ. Then look for an openvpn port:

cd /usr/ports
make search key=openvpn

This will output a number of ports containing the term openvpn. One of them is openvpn-2.3.2 with path net/openvpn.

cd net/openvpn
sudo make install clean

This will have the benefit that the dependencies (here only lzo2) will be properly installed without clobbering your system and you will get additional instructions on how to use openvpn on OpenBSD.

It completely depends on the configure script. If the configure script was generated by autoconf, then the "correct" way to ensure that /usr/local/lib and /usr/local/include are used in the build is to use CONFIG_SITE. That is, either make it global for all you configure invocations by defining CONFIG_SITE in your shell startup files and doing:

cat > $CONFIG_SITE << EOF
CFLAGS="-I/usr/local/include $CFLAGS"
LDFLAGS="-L/usr/local/lib $LDFLAGS"
EOF

or set it only for those configure invocations that use /usr/local as their prefix by adding the above content to /usr/local/etc/config.site. Any invocation of configure that uses --prefix=/usr/local will read /usr/local/etc/config.site (or /usr/local/share/config.site, if you prefer to use that path). Since the default prefix is /usr/local, creating /usr/local/etc/config.site will cause the assignment to be made for any invocation of configure that does not otherwise define a prefix.

Again, note that this is only if the configure script was generated by autoconf.