

Any 18650 with a rated capacity of more than 4Ah is a fake. They will usually be very low capacity. The low weight and the hollow sound when you tap on it is good indicator of that too.
There are a number of reputable sites for buying 18650 cells. Stay away from Amazon and Aliexpress, they are full of fakes.
The SSH and VPN traffic is encrypted. Unless your private keys have been compromised, nobody can see what is going over the tunnel. They can log things like the IP addresses that are connecting to it and how much data is being transferred though.