STM32F4 OTG_FS Leakage
The datasheet isn't entirely clear on how VUSB is handled, but presumably, it's a 5-V tolerant pin. However, it does state under "Absolute Maximum Ratings" that the voltage on any 5V-tolerant pin can't exceed VDD + 4 volts. If you don't have power applied to the chip (VDD = 0V), then applying a VUSB of 5V exceeds this limit.

If this is meant to be a bus-powered device, you need to make sure the CPU gets power right away from VUSB.

If not, then you need to arrange the power to the CPU so that it can be powered up by VUSB and then put into a low-power state whenever the external supply is not present.