I would highly advise against EVER tracking anything through tor. If you want to get a package flagged that would be the best way. It is opsec 101 on the dark web. This is why tracking isn't provided 99% of the time because vendors don't want people using tor to track. Also as far as vpn if you use a provider for a VPN that knows your identity you just completely blew the point of VPN. Just please don't use TOR for tracking people
You may be right.
The government can know all exit nodes of the TOR network and flag those for couriers to look after. But same with VPNs - your VPN provider usually only has a set amount of servers they go through, and usually those IPs all end up getting flagged.
I suppose your best bet ultimately is to rent out your own VPS somewhere like Ukraine and log everything through there. This is obviously the best way to use a self-hosted VPN - its trust-less, as you are the only one logging who logs into it. Well of course, besides the server(s) providers, but thats an issue with every VPN.
I use Mulvad personally - and they claim they don't log your IP, but its a whole another question about the people who provide the shit to them if they log your shit. It's so many layers.
All in all - I have no fucking idea giving it further thought on realistically how to track a package discreetly. You could use a VM + double layer VPN (Secure Core like PVPN has) + TOR and still get flagged. Use ya mom's phone, I guess.
Or find a service that promises tracking with no logging, etc. Or simply, a country that does not respond to most LEO requests unless you are committing a crime against said country.
For anyone looking further into privacy, I recommend privacytools(dot)io or privacyguides over at Reddit. Much to learn. Set your threat level accordingly.