Any process running with our privileges our higher can in theory install a new root certificate. But that does not mean that it will do it. If you take for example the VPN support bundled into Windows (PPTP, L2TP/IPSec) then there is no way for the server to push a new root certificate to your system. The same is true with the original OpenVPN client.
But, if your VPN provider asks you to install specific software to use their VPN then it might be possible that this software will already install a new root CA when you install the software or that it will do it later when instructed by the VPN server. Or it might do even worse things.
VPN software is in this case no different from all the other software you download and install to your system: it can do a lot of harm (adding a new root CA, monitoring you through your webcam, capture all your keystrokes...) and you should install it only if you really trust the vendor and the path how the software gets distributed.