How are the packets transferred between a website and the computer that's using a VPN?
A VPN is just another connection. Your computer makes a connection to the VPN server, and the VPN server makes a connection to the website you want to access.
From the website point of view, your VPN server is making the request. If you are using a popular VPN server, that means that your request and a vast number of another requests will appear to come from that single IP address.
The VPN client usually creates a network interface with a private network range, and add a default route pointing to that interface. As soon as your browser sends the request, the packets will go to that interface and will be intercepted by the VPN client, encrypted, encapsulated and sent to the VPN Server using your default internet connection.
On the VPN server, the packets coming from the VPN client will be processed, decrypted, and the server will establish a connection to the webserver you wanted to contact, changing the TCP source to point at him, not at you. As soon as the webserver sends the response, the same process will occur: the server will encrypt and encapsulate the response, send to you, your VPN client will decrypt the packet and send the result to your browser.
And what protocols are used?
The protocol used by the VPN does not matter much. The main issue is how secure is the encryption of the traffic. PPTP and L2TP are not considered very secure. OpenVPN can be very secure, depending on the configuration options. IpSec can be very secure too.
The protocol used will depend on the VPN server type you are using. If you are using OpenVPN, the protocol will be TLS encapsulated on TCP or UDP. PPTP will use a GRE tunnel over TCP. IpSec will encrypt the IP packet.