VPN is definitely one trigger. A friend with a completely genuine and tame account got blocked for months and the only non-standard thing he did was access it via a VPN.

Unfortunately, the non-spammers using VPNs are unlikely to be desirable users (high level of contribution, receptive to ads) so might be seen as acceptable collateral damage.