Just good old Comcast. I'm boring. 
I guess things have change a lot in the last decade... Back in the day when I worked, we used RSA tokens for 2FA (Two Factor Authentication) but used other software for the actual VPN... For my home networking I don't use a VPN these days... Anything I have that is transmitted over the Internet that I wouldn't want disclosed uses HTTPS, so that good enough for me.
Well, specifically, there are methods of intercepting that cookie that says you're already logged in, although it's not as easy a hack as a malicious wifi hotspot that reads and relays all your traffic, so I'd be wary of that use of your iPad. Using the phone's cell connection is one of the solutions I was going to mention. I also have a VPN set up on my home ASUS router, and OpenVPN installed on my phone and laptops, so that I can safely use public wifi. But DFW_M5, if by "home VPN" you mean using a VPN while on your home ISP network, no, I don't see why anyone would need that except to spoof their location (like for streaming services that block certain geographic locations).
This particular method would allow them to log into your email with that cookie, unless you have additional security features enabled. Or, more accurately, they would have the cookie that tells the mail server that "this browser is already logged into Lsbcal's email". I'm not well versed on the details of what is called a man-in-the-middle attack, just that it is a definite risk in the exact situation you talk about with your iPad.
