> how would you do it

Subpeona the ISP for a list of users that have consistently connected to a range of known VPN provider IP ranges. Then they can filter by other heuristics like amount of data transferred and histograms that show when/how they used it. Unless the VPN provider is implementing advanced antitracking techniques or multihop gateways, it should be pretty easy to get that info since most ISPs are very much at the beck and call of the government.