Wifi 1 is only allowed for corporate issued laptops. We don't even know what the password is.

Wifi 2 for employee personal devices has the password on an internal website and it changes once a month

Wifi 3 changes passwords every 24 hours. It is only for vendors who need internet access to do a demo of their product. When we meet the vendor in a conference room we have to get the password off another web site and then they also get a wifi login screen where they have to list their company name and reason for visit etc.

3 typically requires no password, in the setups like this I've seen. So, bring the VPN.

I have no proof, but given the actions of one employer I believe 2 was for indirectly monitoring what people were doing on their personal devices.

Or 2 could be a "carrot" to prevent people from connecting their personal devices to 1.

If you implement client machine certs, then only corporate imaged machines can connect to 1 in the first place - wired or wireless. 2 and 3 are a bit same-y from my perspective, but the selling point might be “you get a bigger share of the office pipe than the totally open guest network, and fewer restrictions” for 2.