This question cannot really be answered properly in my opinion... Anti-Virus and VPN are two very different things!
Anti-Virus/Internet Security is real protection against malicious software, malicious websites, and in the case of Internet Security (Firewall component support), preventing unwanted in-bound and out-bound connections (known as a "two-way" firewall). Whereas, a Virtual Private Network (VPN) is to help mask your online identity through IP Address (e.g. you live in US and therefore have a US IP address from your ISP -> now it is redirected through a server in Germany, leaving a trail of a German IP belonging to the VPN server used at that moment).
Anti-Virus helps you stay safe generally speaking. VPN helps you stay more anonymous against both genuine people (e.g. website owners) and attackers. The difference is your IP can be used by an attacker for DDOS attacks, scanning for open ports and what-not (which can lead to further attacks) but with Anti-Virus it is trying to prevent an attacker from infecting your system, successfully attacking you with a phishing attack (e.g. malicious URL), and so on.
You need to assess your needs before you can decide which one you'd prefer.
Some people will pick VPN because they may think they are invincible to malicious attacks (trust me, no one is) or because they use free alternates/already have a paid solution which is active. Others will pick Anti-Virus because they would rather a real-time backup buddy before trying to mask their online identity for privacy reasons or whichever.
Both Anti-Virus and VPN are good. Both services there are free alternates than paid. You could use a free AV and a free VPN (although free is usually limited, and there is nothing completely "free" in this world IMO).
Personally I'd go with a paid AV solution like Emsisoft Anti-Malware, Kaspersky (only if the Internet Security) or ESET NOD32 and use a free VPN. Unless I was happy with a free AV like Avast (which collects a lot of data and sells for money) or Windows Defender. Windows Firewall is sufficient though and most AVs rely on WFP (Windows Filtering Platform) made by MS on modern versions of Windows for their firewall anyway.
At the end of the day, VPN or no VPN, there is no such thing as 100% privacy. This is why criminals on the dark web still get caught eventually by slipping up in other ways than IP exposure, and if you were to get infected while using VPN then a kill-switch can occur to leak your IP (or at boot before VPN starts, etc) assuming it is software-based.
I think you should decide which one you think you will need more to determine which path you will go...