If you want to use AdGuard (in Proxy mode) and VPN, then you have to unlock bootloader and root, which defeats many security features of GOS. Your other alternatives are to use VPN + ad domain blocking via private DNS server (like dns.adguard-dns.com), but that prevents some VPN providers from re-directing your queries. For example, using NordVPN with AdGuard DNS prevents NordVPN clients from streaming Netflix, Hulu, and Amazon Prime Video content, but if works fine if you use NordVPN + NordVPN DNS.
For browsing, you can use Uazo's Bromite build that includes EasyList ad-blocking filters - https://github.com/uazo/bromite-buildtools .
Some VPN providers offers ad-blocking DNS services, such as Mullvad's Ad-Blocking DNS and NordVPN CyberSec DNS.