"Team Cymru explicitly markets its product’s capability of being able to track traffic through virtual private networks, and show which server traffic is originating from. "
If you see N bytes flow from IP A to a VPN server then N bytes from that VPN server to IP B at the same time, you can assume that A is accessing B through the VPN. It doesn't always work but the Feds only need to get lucky one time.
It is easier with obscure VPN servers.
Or with very popular one, where thousands of users send thousands of packets N bytes big to the vpn server.