I assume that they are paying special attention to his internet connection considering the extent of his fraud. While a VPN can hide your IP, your ISP can still tell when a connection is using a VPN so if the courts allow law enforcement to monitor his connection then they would know.

Now, if SBF connected through a McDonalds wifi somewhere and they somehow found out it was him using a VPN, that would be concerning because there is no way they should know that its his laptop unless they knew he was on his way there ahead of time and somehow got permission to monitor their public wifi. That feels very unlikely