I feel like the set up is pretty unpenetrable but I'm also starting to question that
Never assume you're invulnerable. It's probably good to be paranoid, but you should define the threat first. What are you worried about getting?
On it I have bitdefender free av and Malwarebytes free that I scan occasionally
This tells me you're worried about malware, right?
Let's look at what you're doing:
I start my cyberghost VPN free version then start a virtual machine through virtualbox of a trial win 8.1
This is wrong. You should be starting the VM, taking a snapshot of the VM, then starting the VPN from inside the VM before browsing to the site. Then, when you're done with the "sketchy site," turning off the VM and restoring the snapshot to a previous time.
This effectively wipes the virtual machine back to the state before you went to the site. "Like it never even happened."
Typically after going to the sketchy site I reset the modem and router after closing the VM then closing the VPN. Is this over kill
This is pointless in terms of securing your machines after "visiting a sketchy site." It's more important that your VPN provider does not keep any logs of personally identifiable information. See also: Which VPN Services Keep You Anonymous in 2017?.
A VPN hides your current address. It does not provide security against viruses. Your router is simply a connection upstream. If your VPN collects info on you, resetting your router is pointless. It's also not relevant.
Is it possible to infect my network by going to something sketchy even with this protection
Yes. Zero day flaws in the operating system make everyone vulnerable. Spear phising and other targeted attacks make you vulnerable. Your humanity is probably your weakest link, but if you're not the active target of a state or bad actor, you probably don't have to worry about this. If you are keeping your hypervisor, operating system and VM operating system up-to-date, you should be pretty well protected.
I also seem to notice that you don't have security installed on your VM? THis topic is a bit of a holy war right now since AV increases the attack surface and relies on hooks in the OS, many people think that 3rd party AV is a bad idea. Still others highly recommend it (Lawrence Abrams from bleepingcomputer.com did an interview with Leo Laporte on TWiT stating he thinks people still need it).
You should (at least) be running Windows Defender on the VM.
You fail to mention what browser you're using... right now Chrome appears to be the most secure, but you should have uBlock origin, https everywhere, and privacy badger running in it... in the VM.
Still one other thing you can do if you're really paranoid ... Tor Browser on top of the VPN with all those add-ons.
But quite honestly, you could very much simplify your life by getting an old laptop, and running Tails from a USB stick from your local Starbucks. Of course, the sketchy site must really be appetizing to make you want to leave the house. But then again ... security is diametrically opposed to convenience.
You could always just ... not visit the sketchy site too.