Let's say there is a "honeypot relay". Beyond capturing the IP in access logs and trying to match that to an event timestamp, what more would be a concern? I'd just treat any relay the same as any clearnet service, like an ISP. Except the relay is only seeing a fraction of what you're do as it's only notes. If anything, I'd be more paranoid of the VPN provider...