someone could steal your hashrate /DNS spoofing/. It happened to the whole ethermine ~2017 year /afaik - then it was another advertised AS (autonomous system), which is totally illegal/.
Is it possible to avoid this by specifying the IP address of the pool? (172.65.245.119)
or this is not pool ip (Cloudflare?)
All IP addresses according to Whois belong to Cloudflare. It has long been customary not to indicate the real IP address due to the threat of DDOS attacks.
Your problem most likely really lies in the VPN service. Try Windscribe, it has free gigabytes of trafic.