You can call VPNs illegal, but you can't enforce it.

You could make them require age verification for example, or you could ban commercial VPN's and only allow self-hosted ones.

Neither is enforceable. You can theoretically detect VPN traffic, but you can't tell if it's commercial or not. Even the detectable part will no longer be true if you make VPNs illegal, as providers will work towards "indetectability". You can have a list of known IPs, but unless the entire world follows you in your ban, that is pointless.

They could also do what Utah did and make it so that you effectively can't access any websites with a VPN

That law existing is more of a demonstration than an actual law, as it is also unenforceable. Sure, you can have a list of known IPs, but that's definitely not reliable and easy to work around.

Most laws about the internet are unenforceable unless you simply turn it off. That's why piracy is still an "issue" despite it costing rights owners a gigantic amount of money and therefore not lacking incentive to deal with. That's why even China and Russia, who are trying to control their network as much as possible, are still unable to enforce their VPN restrictions properly. Even if the US turned fully fascist they wouldn't be able to enforce a VPN ban.