You don't need any vpses if you run them as tor hidden services.

Run each client instance with a different rpcport and in the hidden service config each serive as 9999 -> 127.0.0.1:actualport. set listen=0 so they don't try to clash on the same port. Specify port 9999 in the masternodeaddr. If doing a hot/cold you need to add tor=127.0.0.1:9050 to the cold wallet's config and it needs tor installed also. I've tested this and gotten it working in 2 vms on one machine (1 vm for hot, 1 for cold) and set up 2mn then shut down the cold vm and got payments for both.

With the default tor config(as a client, not a relay) tor makes outgoing connections only, so you don't even need any exposed ports for that setup, and can block all incoming traffic with iptables