There are not many algorithms involved when a VPN server connects to a CEX server on behalf of the VPN user. The CEX server sees a regular TCP/HTTPS connection and there are not many algorithms that the the CEX could break. Moreover the CEX server sees all the data that the client sends to it anyway, and it sees it always regardless of whether the connection is direct or through a VPN.
The main source of information about user's location are:
1. User's IP address.
2. Any HTTP request headers containing IP addresses. These headers could be added by various proxies along the way.
3. The timezone reported by the browser.
4. Any geolocation information provided by the browser if the user allows the browser to provide that information.
A knowledgeable user can easily hide that information.
Additionally the CEX does not really have any benefit from prying too much into the user's information. They make money from the user's transaction so unless the user does something really stupid, the CEX will believe the user when he says that he is not in the EU, especially if the user's IP address confirms that.
Of course all that is true for the CEXes that allow non-KYC accounts. CEXes that have mandatory KYC are other beasts and it is better to avoid them altogether.
A friend of mine also traded and even earned a little. Then he transferred several tens of thousands of dollars to the exchange and they asked him to go through the KYC procedure. After that, he avoids these exchanges.
If the exchange allows you to trade without KYC, this does not mean that you will not be asked to go through this procedure.