Yeah sorry I don’t have experience with Graphene but a quick search seems to say root is very difficult with it. Maybe look into flashing a different custom ROM if you really need this.
One thing I’ve done quite a bit is use my travel router (I have a GL-Inet Slate but there are lots of options) to repeat my hotspot, then connect all my devices via the router. And set the VPN up on the router. This way everything going out over the hotspot is encrypted anyhow.
For my needs, I can power the Slate by plugging it into my laptop or even my phone via usb-c. It’s very portable and versatile. Ymmv.
Granted, you’re using a home setup. But you could still consider setting up the VPN on a central AP and repeating your hotspot through it to make everything going in and out of your network encrypted and more secure. None of your actual traffic (besides what your phone is emitting) will be in the clear, which is better than nothing.
Almost any router with VPN and repeater options will accomplish this if you don’t wanna root your phone. I’ve flashed OpenWRT on the equivalent of router potatoes over the years. It’s pretty straightforward.