An option is also to switch to docker (compose) which would allow you to VPN just the qbit container instead of your whole host machine. Recommend hotio, he has containers for a bunch of apps in this realm and has VPN support built in with pia support.
What this person said for the grab event to find where it came from and sonarr also has a new setting per indexer to fail unsafe downloads, the only drawback is you have to let your downloader download the file in the first place.
The alternative is blocking the files with your download client by extension and then manual intervention.