What cases are you talking about? My general understanding is that if the VPN provider does not keep any logs, all that is left is timing / bandwidth correlation. If the endpoint you are connecting to isn't compromised and you connect to a high traffic node wouldn't this be essentially impossible? Unless you do some user error stuff like logging into accounts tied to your public persona?