If using https, and hsts, and verifying the certificate is valid, are my connection safe, if not using vpn?
If you are using HTTPS with a valid certificate, then Transport Layer Security (TLS, née SSL) is likely adequately protecting your communication with the server that sent the certificate.
An attacker on the network may still be able to see things like the IP address of the server you are communicating with (or other header data below the application layer). But the application layer data (in this case the HTTP data and headers) will be encrypted with TLS (the S in HTTPS) and thus the network attacker will not be able to see that data.
In other words, for the most part, yes it is safe without VPN.
The above statement is subject to the usual caveat that threat models will vary. E.g., if an attacker has access to your computer and can run, say, super user processes on your local machine, then they can likely steal your data prior to TLS encryption. Additionally, if you are not positive that the certificate is valid, then the above mentioned safety would not apply. Etc.