With a VPN, it ultimately depends on if it's a "known" VPN service or not. There are ways to check an IP to a location, and if it's originating out of a data center, it's a pretty good bet that it is a VPN connection. But I can use my home ISP service as a VPN also due to the router. Someone coming in via a VPN does not equate to "bad behavior" if that's what you are asking about.
As for BOT vs Human... there are some really good add-ons (paid) for XF that can help with that a lot and have been shown to be very successful at it.
Two of the better known ones are (back in the 1.x days I used the TPU originated one and it worked well for humans)
There is a 10% tax added to our products. We do not offer invoices, you need to use your PayPal Receipt for your accounting or VAT needs. Tax will be added at checkout. This addon is another tool in fighting spam bot registrations at your forum...
From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...
The add-ons that @Tracy Perry suggested can help, but I've found a little bit of setup on the built-in spam management can work wonders as well. We set up our management with the askimet and project honey pot API keys to check every new registration and post, and we use spam phrases to catch common bot language. Coupled with whatever flavor of captcha is currently working best, it catches 95% of bot traffic for us. Ultimately it can never be 100%, especially since some "bots" are actually humans posting spam. Maybe try reviewing your current settings along with the add-ons to make sure you are covering all your bases.