It all has to pass through a router at some point, and the VPN will have a specific signature especially around connecting to the VPN server itself. Might have to put your threat hunting hat on to find it though. If my kid really does start getting clever there, then we start talking about CTFs and the wonderful world and compensation of Infosec.

If cellular, I’d roll with family iPhones and app restrictions on the kids’ phones, plus a lot of careful messaging.