So then we randomize the padding, what's next?

How else do they figure it out? My mind jumps directly to funny traffic patterns like a single person using the domain or maybe a non-normal looking website that doesn't serve static assets to non-vpn users or other normal things, etc. Can they probe the server somehow and and figure out it's a vpn?

Does the user need to visit other sites unrelated to the vpn in order to mask their own usage and appear normal?