Windows devices have a global device identifier that basically removes any anonymity you think you have behind a VPN (VPNs are largely useless anyway in my opinion, but you should use one). Linux has a similar GDID at /etc/machine-id which browsers may be able to read.

The best thing to do is not do anything illegal. As I've said before, if the government wants to get you, they have infinite resources and in-roads with every company ever. Just don't be a retard online and you'll be okay.