The same databases that allow you to resolve geoip location typically also would get you ASN for free and then you can try to filter out obvious non-residential IP blocks. Just looking for M247 alone (major bulletproof hoster frequently used by VPN companies) would probably detect at least half of all commercial VPN IPs including most of Nordvpn's.