Is it possible to get hacked based on those settings?
There is no such thing as 100% security - security measures only help to reduce the risk but will not fully eliminate all risks.
While you've cared about some aspects of security you either did not care about others or did not find them worth to mention. There is for example the physical security, i.e. who might have physical access to your computer and will you be able to detect if somebody unauthorized got access and changed parts of the system. Note that just having a strong password is usually not enough against physical attacks: the attacker might boot with its own OS to make changes to your system from "outside", the attacker might install key loggers, ... And if you are a really valuable target then an attacker might break into your home or bribe or blackmail persons you trust to mount the attacks.
There are also several other aspects you did not discuss, i.e. is web browsing really the only thing you do or do you also read mail with a mail application, play games which have their own online connection, have software installed which will fetch its updates from the internet ... - all these are also possible attack vectors. For example it is not uncommon that software updates are not (properly) signed and not transferred securely, so a man-in-the-middle attack might maybe replace the software update with something malicious.
And finally lets have a look what you actually do with your browser. Even if script is off you will probably look at images and videos and also load fonts. While you are probably aware of images and videos you might not be aware that many sites load fonts from the internet to display the content. And, malicious fonts were in the past several times a successful attack vector. Similar image and video are actually complex file formats and display engine are commonly optimized to display the content fast and efficient and do commonly not to expect malformed content. Thus in the past it was possible to exploit systems also with prepared images.
As for the VPN: it protects only the path from your computer to the VPN endpoint. It does not protect the path from the VPN endpoint to whatever server you visit. Apart from that you really have to trust the VPN provider since he is able to modify all of your content, i.e. both what you send to some server and what the server sends to you. For example in the past there were malicious Tor exit nodes which added malware to downloads on the fly.
And, this is only a part of the possible attacks. Do not forget that there are also brute force attacks, in the literal interpretation.