I would think the principle would be the same as if a Utah resident bought something that is legal in Colorado but then brought it back to Utah to use: they are breaking Utah law (possession and use, probably) even though it was legal to buy and use where they bought it. I could see where an overzealous DA in Utah could subpoena usage logs of a VPN provider if someone were caught illegally accessing content in a jurisdiction. I know Mullvad doesn't keep user logs; I don't know if they are the exception or this is generally the rule.