Can I delay a systemd script from running at boot?

Your problem is the Type=simple in the description of the VPN service. The Arch wiki clarifies the manual page, a little:

Type=simple (default): systemd considers the service to be started up immediately. The process must not fork. Do not use this type if other services need to be ordered on this service, unless it is socket activated.

You probably can make this work by changing the type:

Type=oneshot: this is useful for scripts that do a single job and then exit. You may want to set RemainAfterExit=yes as well so that systemd still considers the service as active after the process has exited.