Plex/Sonarr etc don't handle the actual downloading part, so they don't need to be behind a VPN. They simply look up the show metadata from public databases and find downloads available from indexes you have registered, passing on the download that best fits your criteria to whatever download client you have configured (so the download client is the only part that needs to be behind a VPN).