The VPS provider would only see traffic going outbound, not the contents of said traffic, I don't see how they could read the traffic if the packets are encrypted. If you also encrypt the volume and disable pw login and rely solely on pk SSH to authenticate, there is no way even for the hypervisor console to even get into your system, best they can do is reboot from the Hypervisor or nuke it. You can also purge your own logs on the VPS.
You can make it extremely difficult for them and not worth their time. There is no 100% secure system, but we can get pretty close.
The packets are encrypted. LE can get your VPN encryption keys from the VPS.
Hence, they can decrypt the captured encrypted traffic. Definitely smarts to encrypt the drives separately, and disabling pw login.
It all depends on who you've pissed off. If you've got a nation-state power like the CIA after you, there's basically nothing you can do to protect yourself, short of going fully off-grid.
(post is archived)