There’s a few different options for VPN.

1. I would suggest Njalla. They offer a VPN, domain name registration, and VPS services. They’re based in Costa Rica, and they have a bit of an infamous reputation for protecting quite a few piracy sites, so you don’t have to worry about them caring if you’re sailing the High Seas.
2. Mullvad is another one that’s recommended, but they apparently removed the option to port forward after they got heat for supporting piracy, from what I’ve heard from users. I don’t know if that’s true, so you would have to ask around.
3. There’s also cryptostorm, if you’re REALLY paranoid. They offer a token based authentication system that doesn’t use accounts, so they don’t keep any information on their users. Instead, the token starts a timer as soon as you first use it. You can purchase tokens using cryptocurrency, so if you’re into that, you could make it so they have no idea who you are, and there’s no information they could provide to the authorities.
4. Host your own. You can set up a VPN service pretty easily by renting a VPS and just installing the needed software. This has the added bonus of you probably not needing to worry about websites blocking you for being on a VPN. You could also very easily do something like set up fedi software such as Lemmy or Mastodon, or use it to host a blog or whatever.

I would not recommend Proton if you’re going to be pirating. Proton uses a random port for forwarding each time you connect, to make it harder for people to pirate. I use it, but my download clients are Docker containers that use a script that automatically sets them to the right port each time Proton connects, so there’s no issue. Otherwise, I would have to manually set the correct port every time I used the client. Proton is hosted in Switzerland, which is outside the US jurisdiction, so despite the recent uproar over them, they are the safest choice since it’s illegal for them to provide private information to other governments, such as the US.

As for mail service, it’s not difficult to find good ones, since mail is pretty simple, but keep in mind that there is no mail service that’s going to refuse a court order for your data from their own government, so if you’re planning on doing something illegal, or if you’re going to be engaging in activism, then you need to find a provider that’s outside the jurisdiction of your country or it’s allies. For someone in the US, that might mean going to Switzerland or Russia for a provider. Any mail service will do fine, as you can easily encrypt your mail using PGP. There are some that would say that’s not secure enough, and while they have a point that it’s not the most secure, it’s good enough for the vast majority of users. Most people aren’t talking about anything that a government or hacker is going to want bad enough they spend the time decrypting your emails. And if they did want it that bad, it would be easier for a government to just raid your house and poke through your computer as they please.