It is definitely more common on VPN IPs, since Google likely identifies the outgoing address as a datacentre, and gets suspicious.