I am guessing more VPN accounts tend to be purchased using stolen credit card numbers than an average online transaction. As crackers use VPN services to render their own services.

The number of chargebacks or fradulent transactions reported on your merchant account usually raises red flags and calls for account review. I am sure its pretty easy for paypal to identify such accounts with the data they have.

When carding, which means using stolen credit cards to buy things online, people usually use two layers of security: a VPN, then a SOCKS5 proxy. The latter is usually geographically located in the country/city your card is from to circumvent CC provider checks. Both components are commonly bought from traders who again use stolen CCs to buy/rent them.

If you were going to commit fraud, wouldn't you take steps to be anonymous? I'd guess PayPal has data that shows a significant number of fraudulent transactions happen through VPNs.