Usenet doesn't need a VPN because it's a direct download, it's encrypted with TLS.

For torrents, you will have to put your torrent client behind a VPN, but it's recommended to leave everything else(e.g. *arrs) not behind a VPN so it doesn't misbehave. If you're using docker, you can use a container with a built-in VPN like https://haugene.github.io/docker-transmission-openvpn/config-options/

You are connecting to usenets servers via an encrypted connection and downloading directly from them. Your isp cannot inspect this traffic because of the encryption and you are not publicly broadcasting your actions (unlike with torrents) besides the initial connection to a usenet server which in itself is perfectly fine. It's primary a message board system that also happens to be leveraged for file sharing. Nothing inherently illegal about that.

The usenet host assumes all the risk by hosting the content. It's up to them to not be hosting illegal/copyrighted content. You're just reading publicly available messages.