Check if airvpn client has a Killswitch option.
Are you using docker? If so, you may use gluetun or run the vpn client inside the qbittirent container
Also, some vpn provide adblocking. So, another way would be... skip pihole and just use raspAP to create a WLAN where all devices connect. You may even turn off your router wifi and rename the newly created WLAN so that your brother doesn't even know ;)
I haven't tried it really, but maybe there are tutorials.