this (practically ubiquitous use of VPNs) is the number one reason sec analysts hate impossible travel alerts lol.

A better technical solution is prevention of access via IP allowlisting and then only allowing specific (Corp VPN) addresses.