for implicit it is reverse-geocoded from your IP address for explicit it is using device GPS and/or cell tower either you are not actually connected to the VP

for implicit it is reverse-geocoded from your IP address for explicit it is using device GPS and/or cell tower either you are not actually connected to the VPN or the website is storing your consent to access GPS coordinates. I'm not sure which is scarier to test the former go to a few different websites that tell you your IP address for the latter, fully clear your browser's cookies and cache and retry. does it ask to access fine location? another reason could be that you are logged in to e.g. google who already knows where you are based on historic searches, nearby wifi and bluetooth devices, etc.