Timing attacks are a thing and behavior can be correlated by metadata and situational considerations, e.g. Bob only uses his VPN at night, and only for 21 minutes on average. Jane uses her VPN from roughly 830am to 515pm M-F. What do those patterns mean?
But so long as it works and the costs are low, use the VPN constantly. And always check for leaks.