A VPN provider can potentially log every site you visit, just like your ISP.
The actual benefits are mostly practical, being able to access streaming services and other sites from other countries.
It does hide your IP but this isn’t as big a deal as you might think, and moot, if the ISP logs your activity.
It does not provide some special extra layer of encryption. It does encrypt the traffic, but most of the time, it was already encrypted anyway. The vast majority of internet traffic is.
Is it actually being used?
My guess it just doesn’t evict stuff from before the suspend, starts re-loading stuff after the resume, which makes the apparent amount “used” go up.
On a normal linux system, “free” RAM will over time drop down to zero, as the kernel puts the extra memory available to use. But it doesn’t mean there isn’t room to evict less-needed stuff if necessary.
AFAIK linux only starts actively evicting RAM once it fills up.
Like the other guy mentioned, drill down and see if yiu can find the actual program causing the problem.