By combining VPN use and MAC address randomization, you mitigate many risks, but some vulnerabilities still persis, e.g. DNS leaks, compromised VPN, browser fingerprint, session tracking, behaviour analysis.