In general, TLS MiTM can replace one self signed cert with another and then see all your traffic.
When you click through the error for a self-signed certificate and connect to the HTTPS server regardless, unless you have viewed the certificate hash (fingerprint) or the public key's hash (fingerprint) and verified it is the same value as last time (when you are reasonably sure you were not MiTM'd), the self-signed certificate can be replaced by another self-signed certificate and you wouldn't notice. Anyone in main-in-the-middle position can do that and then read (and modify!) all traffic.
Checking that the certificate (or public key) are the same as values you trust is called certificate pinning. Some apps do this in code, with the trusted hash baked into the code, and then it makes sense and means using self-signed certs (or certs issued by an untrusted corporate CA) is secure.
Performing the certificate pinning check manually is possible, but I would not trust a user to do it diligently.
But this only lets you know whether the certificate is different from last time. How do you know the certificate is good the first time? If you are MiTM'd the first time, verifying on subsequent connections that the cert is the same won't help. That is kinda the problem with self-signed certs and what CAs like Let's Encrypt solve. But if you have an out-of-band way to know the cert is legit on the first connection (e.g. site owner published hash of cert on twitter), relying on pinning for subsequent connections is ok.
Why not use a trusted Let's Encrypt certificate?
If you mean the certificate of the VPN itself is self-signed, then apply all of the above to a MiTM between yourself and the VPN. But HTTPS connections using legit certificates performed inside the VPN should be secure from the VPN operator. They will know which sites you connect to, but they will not see your passwords. Traffic analysis can let them guess the content you browse based on data sizes and timing. For example, popular netflix movies and wikipedia articles are recognizable in encrypted traffic just by the size of the download!