Listen To the Baz Luhmann song "Everybody's Free (To Wear Sunscreen)". A lot of it is pretty good advice.
I regret not having invested in index funds at that age. I'm very happy I backpacked the earth for 1.5 years as soon as I could afford it. When looking for a job: do the things you enjoy most, aim high and go for it. Do not try to find your calling: try different things and your calling will find you.
I assume that all national security agencies monitor all traffic and can already see I only connect to Mullvad. And I'm sure they will have noticed I use it when going through the logs of several SaaS services and see that it is always a Mullvad IP that uses my account. No secret IMHO
What is the threat model where correlating the payment with the account number is the main threat? If you can relate the account number to Mullvad traffic, then isn't it far easier to monitor the traffic and see what IP is connecting through it (my local ISP IP)? And if you cannot, what harm is there in knowing someone uses Mullvad? I pay by bank card and I don't see the risk here.