Perhaps some context would be worthwhile...
A VPN connection can only protect traffic between the VPN Client and the VPN Gateway. If you are running your own Gateway, while the VPN is active (and a no-split-tunnel traffic policy is applied) all traffic to your Gateway will have protection of the VPN tunnel between these two endpoints.
If instead you are connecting to a commercial VPN Service, your VPN traffic will be protected as far as your VPN Provider's Gateway - where it will be delivered to (and traverse) the internet without benefit of the VPN. As such, when connecting to an untrusted public WiFi, all of your network traffic will be protected over the least-trustworthy public WiFi connection - but receive no additional protection from where your traffic exits the VPN at the Gateway.
It is when using untrusted WiFi networks that Commercial VPN Apps may have useful utility - but you must consider that your unencrypted data remains visible to the VPN Provider. Choose your Provider with care - as not all are themselves trustworthy.
Also consider that much of your network traffic is already encrypted, by default, using TLS/SSL. That said, there are some network protocols (such as DNS) that do not have benefit of encryption - and this traffic can be intercepted or maliciously manipulated. This risk can be mitigated using DoH, DoT or ODoH protocols.
DoH and DoT are natively supported by iOS/iPadOS, but are not exposed via iPad settings; to configure and use these protocols you will need to use a third-party App - such as DNSecure. ODoH is also natively supported - but is only available to iCloud+ subscribers using Apple's Private Relay function.