I agree with your speculation, this looks like a timing attack regarding a Tor or VPN server.
That said, while catching pedos is a good thing, their methods are still concerning for regular law abiding citizens. The road to hell is paved with good intentions…