for implicit it is reverse-geocoded from your IP address

for explicit it is using device GPS and/or cell tower

either you are not actually connected to the VPN or the website is storing your consent to access GPS coordinates. I'm not sure which is scarier

to test the former go to a few different websites that tell you your IP address

for the latter, fully clear your browser's cookies and cache and retry. does it ask to access fine location?

another reason could be that you are logged in to e.g. google who already knows where you are based on historic searches, nearby wifi and bluetooth devices, etc.

Thank you for the response, most likely it is browser cookies, as I've checked my IP address has changed and that there are no leaks. I will try running from a different browser in incognito mode to see if it still works.

WebRTC leaks expose your real identity and location even when you use a VPN. You should disable it in your browsers.

Agreed, I disable WebRTC, and run uBlock Origin and Privacy Badger.

The geolocation API uses location services on your device. This doesn't rely on your IP and instead looks at nearby WiFi access points and uses a 3rd party service to translate them to GPS locations.