You may also want to include device temperature if that can be polled.
Spanning tree could be a very chatty alert.
You might want to include syslog criticals coming off any important equipment.
High utilization might be tough to do on VPN sites depending on their connection and their setup. IE if you are monitoring a device witch connects to a DSL modem that 10/100 interface will never have a high utilization.
In my general experience too many alerts is as bad as not enough as it will cause people to ignore them and when something important happens it gets ignored.
Just my 2 cents.