It's mainly because nearly all VPN providers all use the same shady providers - M247, xtom, fdc, datapacket etc.. Most CDN setups will "challenge" those ASNs.

People think Mullvad is special but it's same shit as all the others in most cities/markets, I wish they would use some of their big ad money spend to deleverage from these typical dodgy scam hosting ASNs.