Deep packet inspection can detect VPNs. The problem may be more that people have legitimate uses for VPNs, like at their work. Those could be whitelisted though.