Comment by spacebanana7

It all depends what your privacy threat model is.

There are very few organisations capable of identifying the human user behind a Mullvad connection with a VM.

If you're worried about local law enforcement or advertisers it's probably enough.