I do this with passwords, too. For example, generate 15 digits and add 5 digits (like +LMY!) to end. Many of those sites will list which passwords were stolen, easy to see to see which sites have unforgivably poor security.

For email addresses, the variation is useful, but it’s probably inevitable that it’s eventually sold, stolen or guessed. Still nice to have the evidence.

I also use PIA, for many years now. The performance for price has always been fantastic, along with their policies. However, I’m becoming worried about the company now, noticing signs of bad health. Software development and updates have stopped (I’ve now switched to OpenVPN). Help and documentation has stopped (and blog/news). Customer service seems extremely understaffed as well.