Advanced DPI can identify Tor behind a VPN, but now we are talking about a state level targeted surveillance with Packet Size and Inter-Arrival Timing, Entropy Analysis etc.
Not your garden variety mass surveillance.
If you’ve been blocked using the Tor → VPN setup (and the NSA is not after you), it’s probably due to the VPN server, not TOR.
I think what you are doing is hurting your anonymity rather than helping it.
As far as hiding the use of Qubes, why not just do updates through Tor?
If you can connect to a VPN through it, you can download updates too.
It’s not like ‘they’ will target you because they see someone (amongst many users) updating multiple distros at the same time over Tor. I don’t think this should be a concern.