When num lock is on, the scancode reported for numpad 5 is SDL_SCANCODE_KP_5, which is correct. However, when num lock is off, windows reports the VK_CLEAR virtual key code, which is incorrectly translated into SDL_SCANCODE_CLEAR inside of the VKeytoScancode(WPARAM vkey) function.
Like all the other numpad keys (and following the entire point of scan codes to begin with), numpad 5 should always map to SDL_SCANCODE_KP_5.
Personally I feel like the entire VKeytoScancode function smells, since the scan code mapping from Windows to SDL should never require any virtual key code knowledge, so there might be more similar bugs there that nobody has found yet.