My proposition here is that your machine (current mac address) will be once online, through a location used once, with dns-leak protection - yes, your machine will be fingerprinted once, and if the only thing you do when using this particular config is pulling software from the opensuse repos, and pay attention to only ever after live your online life with the spoofed mac and another VPN location, connecting both gonna be near impossible. Who’s gonna fingerprint you anyway, if really the only use of the network is the Suse installer pulling rpm’s from its own repos? At that, Nord isn’t worst than any other since the internet provider for the connection can only sniff you going to some X location for an hour or so.

Extra Paranoid Step, do it from any public free WiFi across town or something.

You know, at the end of the day, fingerprinting works very well even behind the standard privacy protection we all know about. An interesting concept I read here was that the more addons / special stuff you add to protect you, the more “unique” is your profile, enabling efficient tracking!

Good luck with all this

Tumbleweed/ProtonVPN here

As a rule of thumb, the vpns you see the most ads for are the worst (assuming you see ads). I like airvpn, but mullvad is good if you don’t need port forwarding. NordVPN, as far as I know, is one of the worst.