The best way to find out if this is an issue with permissions is to create a new Vault service account, assign the permissions as described in the Installing and Configuring guide for Vault, search for The Vault Service account.
Try starting the Journal task with the new VSA and it should work.
Then you have 2 choices:
1. Try and find out what the difference is between the original and the new accounts
(GPO, permissions, group memberships etc etc)
If you can find the difference you should be able to resolve the issue.
2. Forget about the original account and change everything to suit the new account (SQL DB rights, account used to start services, etc etc)
and try and keep a track on any changes to policies within the domain or a better control on who is changing accounts or their permissions.
I had the same issue, it was caused by a new service provider messing around with policies and not understanding what they were doing.
Good luck