People do it to hide their location from Netflix. Don't think they care about NSA.
Apart from using a deny list that you can find on Github, you just look at the size of the subnet the IP is coming from in WHOIS output. VPN IP adresses are part of very small subnets unlike legit ISP ip addresses that come from wide subnets
https://github.com/ugjka/flipbot/blob/master/trigger_vpn.go (it is not pretty, i know, but it worked)
Yes, AT&T has been shown to be doing all these things.