For the VDL2 drops, this issue is resolved in NSX-T 3.2.2, whereby the counter will not mark these packets as dropped packets.
For the SWSEC drops, please disable the DHCP server block setting on the Segment Security Profile applied to the segment the edge node is attached to.
Workaround:
For the VDL2 drops, no action is required and correct accounting will be implemented from NSX-T 3.2.2 onwards.
For SWSEC, as above, please disable the DHCP server block setting on the Segment Security Profile applied to the segment the edge node is attached to.