If for example I upload same image again but this time using a vpn, would the metadata generate a different CID?
No.
CID are based on one only thing IPLD content.
And IPLD content is based on two things, the actual content of your data and the layout which depends on your chunker algorithm, CID versions and dag layout.
All of them are just option you can configure.
If you just use the same options twice you are gonna produce the same CID no matter what.