I was wondering if we push our DNS over the VPN and basically let them do DNS resolution, is it possible to perform DNS poisoning and man in the middle attack on us? I know browsers check certificates but is there any other security layer that prevents a VPN provider to do that?
If you use plaintext UDP for DNS queries, then nothing prevents the VPN from forging the response. However, this is only a problem for plaintext protocols like HTTP which are vulnerable to man-in-the-middle attacks, anyway. When you use HTTPS, then forged DNS responses can only be used to block access to the target site. It's not possible to perform a man-in-the-middle attack due to the certificate check, as you already stated.
Additionally, you can make DNS requests over TLS (DoT) or HTTPS (DoH) to prevent forged DNS responses.