[skygazer]

Wait, so it would have, ironically, been safer to allow microsoft telemetry to bypass the VPN entirely and remain associated only with their home network, because it's the phone home to microsoft tunneled through the VPN that tied together all their IP addresses to a single microsoft account. The GDID itself is almost a red herring, as it could have been a session id or username or something only long lived enough to appear comming from several ip addresses to windows update request?

[Quarrel]

Indeed, I think this is the correct take.

If they'd done their VPN/dirty work in a linux VM/container, with the VPN running in that, they'd have been fine.

Clean-them would have had their GDID on their normal ISP IP or equivalent, and Dirty-them would have had everything through the VPN from their no-telemetry dirty-host.