If you cannot determine the traffic type, you can block it and wait until someone appears with proper documentation and explains what they were sending.

That's what the judge agreed with: it's unreasonable to require you to block all Internet traffic with the assumption it's all VPN traffic until proven otherwise.

Under Utah's law as written, a private business has to assume any single IP address could be operating a VPN/proxy.