Masking your IP is the main fix, and Tor beats a VPN here: with a VPN, the provider sees your real IP instead of the node.
But your IP isn't all a remote node gets. Per the Monero docs, it still sees the transactions you send and which outputs they spend from. A dishonest node can also inflate fee estimates or hand you biased decoys.
So: check the fee before confirming, prefer a node you trust reached as an onion service, and never mark a public node as trusted, since that reveals which outputs you own.
That's how I'd judge wallets too: Tor support and node choice matter more than the UI.