VPN's just help provide an encypted tunnel and a somewhat IP masking. However, unless your using a lot of public wifi, a VPN in my opinion is not really necessary. There are two good factors for security...
1. Good tools. So the VPN I guess would classify as one as it technically provides a secure connection when working with shady networks. Next I always recommend a good active protection Anti-Virus(AV). Some good free AV's that are no cost is Sophos Home and Windows Defender (Built into Windows 10). For paid I personally can only recommend Sophos Home Premium, Avast and ESET as, those are the only ones I have ever used. Another tool which I use is an ad blocker. I prefer Adguard but, everyone will have their own preference.
2. Education. I have never actually had a virus that I know of. I pay attention to where I am going on the internet, especially to the URL name and if the site is using HTTPS. I don't go to random un-respectable websites. No matter how many tools you use, you are the best security tool for you and your data. I tell this line to my staff every six months when we do our IT security training. When I started at my company we had enterprise AV, an enterprise firewall, and Spam filter. We would get viruses on the network weekly, which is problem when you are a integrated healthcare provider. I started a semi annual IT security training with our staff to better teach them what to look for when working on a computer all day. I am proud to say in over two years we may have had only two viruses on the network and nothing even that dangerous. With over 135 employees that is a think an accomplishment.
Get a decent AV, ad blocker and teach yourself some security practices and what to look for while using the internet and you will be just fine.