It’s just a basic IP blacklist, not a true VPN ban. They’re not going out of their way to block every VPN server. Shortly after the Reddit API exodus, some bad actors were using VPNs to spam CSAM everywhere, trying to get instances shut down. This was before automod capabilities were really fleshed out, and child porn laws made it illegal for the instance owners to have it uploaded or even cached. So it was a big issue where several instances started locking sign-ups and blanket defederating to try and avoid the CSAM getting cached via users scrolling past it. Attackers started finding abandoned instances with lax sign-up rules, and would create like a dozen accounts to spam from; many instances switched to federation whitelists (instead of blacklists), so those smaller zombie instances wouldn’t be federated by default. So if you’re on a VPN, you might be fine. But you also might be blocked, if you land on the same IP that someone uploaded CSAM from.