The thing about using free security service (in MY poor little mind, at least) is the old line, "You get what you pay for."
But you should know why you are using a security package.
The security software generally sets the settings in Microsoft security suite and lets MS do most of the work. It then monitors MS security looking for things that might get past it.
If you know enough about Windows Security, then by all means set it up and use it. The default is pretty good for most attacks you are likely to encounter, but you really should understand how it works, if you're going to depend on it.
As for a VPN, most of the time you probably don't need one, but then, most of the time, you don't need those airbags in your car, either.