for explicit it is using device GPS and/or cell tower
either you are not actually connected to the VPN or the website is storing your consent to access GPS coordinates. I'm not sure which is scarier
to test the former go to a few different websites that tell you your IP address
for the latter, fully clear your browser's cookies and cache and retry. does it ask to access fine location?
another reason could be that you are logged in to e.g. google who already knows where you are based on historic searches, nearby wifi and bluetooth devices, etc.