The Play edition uses firebase, the FDroid edition uses UnifiedPush with your server of preference. The notifications themselves are giftwrapped, so neither Google, nor your UnifiedPush server can see anything, not even your public key.
VPN + Tor, just hides the traffic from your ISP. To relays and others, the Tor exit node is still the same for both accounts. So they can reasonably see which accounts go together if they track you over time.
If apps have Tor internally, they can choose different Tor sessions per account and even per nostrs filter. It's a lot of work to make it work, but possible.