Actually, the ISP logs your encrypted data as well as none encrypted. I know this for a fact because your ISP allows encrypted packets. They can block them if asked to do so. So essentially all VPNs are at the mercy of the ISP.
So how do they connect your encrypted data with this website for example? Well, that is where the OSI model comes to mess with you. You have two essential functions one is ARP the other is MAC. The one that might get you in trouble is the MAC Table. See the MAC table that sits on layer two holds two very important details. The first is the physical switch port and the second is your MAC tables map. Now the breakout computer on the VPN or Tor for this matter needs to know where you are otherwise it can't send the requested information back to you. Yes, this is stored in volatile memory, that is how they protect you. That MAC table gets trashed as the memory refreshes. Secondly, some VPNs don't even hide it because it is not part of the TCP/IP stack. But if they really want to find you, all they have to do is match the breakout MAC that is not encrypted with the inbound MAC that is not encrypted. But it is not something someone can do remotely. They need to compromise the breakout server.
Now it is a hell of a lot of trouble to through as they will need court orders and all kinds of legal stuff. But since you used the keyword Russia they might be interested. Anyhow this is how it was explained to me, I might have left something out. I only did a few pen-testing workshops with a couple of friends. But it is fun it is a lot of fun. We use our old hardware setup servers and stuff and then we learn how to do stuff..