Bear in mind: Changing your mac address on your end point machine (PC, Mac, Whatever) will not do anything at all - as in 99.9% of cases your end point machine is NOT accessible directly from outside as you get one IP address and that goes to your router. The only mac address they see is the router's. Or they would.... apart from the fact that MAC addresses are not routable across the Internet. No-one can access machines inside your network - unless they have already compromised your router, or through any ports you have forwarded to your end point machines. Machines behind the router - using private address space are simply invisible and inaccessible to the outside world. No, this isn't me being naive, this is simply how IPV4 was created (
https://en.wikipedia.org/wiki/Private_network). These addresses are unrouteable on the internet (core routers will not forward packets to/from them directly). Additionally its TCP/IP that's routed and exploited - not MAC addresses that cannot be seen outside your local area network (more later).
Obviously this doesn't mean that you are "safe" behind your router, but it does mean that they need to either find an exploit for that, OR you need to forward ports from it to your end point machine (and THEN that being unprotected is an attack vector), or as is the case in the majority of cases, your machine needs to initiate the conversation with the one trying to get into your systems. This is almost always via social engineering: An email saying something like "Your computer is infected with malware, click here to clean your computer" which of course if you fall for it, you INSTALL the malware yourself. The weakest part of any IT security is the users. It's far easier to socially engineer someone to do something "silly" than it is to break through a firewall.
For MOST actual vulnerabilities you actually need access to the network at some level already - and then escalate permissions via a bug. This is not always the case - but mostly true (many years ago there was a bug in the Linux kernel that if someone simply sent a sequence to the computer with no permissions - just exploiting a bug in the TCP/IP stack - it would open a root shell for them! I discovered a nice little rootkit on one of my servers around 15 years ago due to this!
Anyway... rambling aside..... While its always a good idea to use a VPN, it is at the end of the day just another NAT router. VERY useful for hiding where you are coming from but doesn't do anything more than your own router should do for protecting people from accessing your end point machine. Additionally MAC addresses are NOT routable or discoverable on the internet - they are at a totally different (lower) network layer to IP addresses and TCP/IP can't route them (
https://www.networkstraining.com/differences-between-mac-a...). For a MAC address to mean anything at all to anyone, they need to be on your local area network to begin with - and if that is split up into vlans or any other segmentation then that means on the local subnet too. The only really good reason to change your MAC address is that if your router is connected via cable or ADSL to your ISP on a dynamic IP connection, then if you change your MAC address (depending in the setup) it may cause the provider to issue you a NEW IP address which CAN help protect you. Of course, if you run any type of server software (WebServer, OS Robust/Simulator) then changing your IP address throws out your DNS for people to find you and also throws out connections across hypergrid etc etc. Besides, if you are running services like that - then changing your IP and "hiding" yourself is counter-productive anyway as you are just going to go tell people where you are now.
EDIT: Just to say that running server software on one machine on your network thus changing your IP address being counterproductive, doesn't mean it's not worth running VPN software on other end point machines. It's also potentially a good way to test the security of your own setup - as you will not see your own network as if you were part of it - but as if you were coming from somewhere else (depending on setup - split routes etc). It's NOT a good idea to run a service like OS through a VPN though (many routers can connect to a VPN by default for ALL traffic if you configure this), as again this will mean a regularly changing IP address which is not good for servers.
Just remember, a VPN hides you.... but it doesnt PROTECT you. You need your firewall configured properly on your end for that, including not allowing ports open or worse - forwarded - you dont need.