Multiple SA are created in three scenarios:
Policy based VPN when you have more than one subnet on at least one side of the VPN
route based VPN when you configure traffic selectors
route based VPN when you configure proxy-id
Each set of subnets one local and one remote create an SA