This is anecdotal and does not warrant any legal advice. Many users on the forum are unqualified. Naturally, when purchasing something online that is illegal, you take risks with a chance of being arrested.
- You are more likely to receive a "love letter" by the police than be arrested. A love letter essentially is a postal letter how they intersected a package and know about your purchase. This may warrant them to check your mail for a continued period. You will not know how long your mail is hot.
- A package sent internationally has more risks associated with it than purchasing product domestically.
- If you purchase personal amounts, you are decreasing the risks associated with purchasing product in the first place.
- Purchasing from an exchange is not illegal, nor is it illegal to deposit money into someone's BTC wallet. In nature you should not directly deposit from an exchange to a market's escrow account. BTC transactions are all able to be investigated. The risks associated with depositing from an exchange to a market's escrow is getting your account banned.
- Tails (or Whonix; more technical and not necessary) is recommended. Tails runs in RAM and RAM is volatile. Meaning once you shut down your computer, anything that was in RAM is unable to be recovered.
- If you purchase from a personal computer, there are risks associated with it. A warrant could potentially make it where any electronic devices are seized for investigation. When you use Tails on a USB, you are mitigating these risks. You can also dispose of a USB.
- VPNs are essentially worthless unless you paid in cash, and your connection has always been made on someone's hotspot. Once you've signed on from a VPN at your house, you are no longer anonymous with that VPN. VPN companies are glorified traffic resellers, it is no safer than using HTTPS on your own network. Do not believe in "no log VPNs" because you have not personally audited that company. Also, no log VPNs have to somehow troubleshoot customer's problems... and there is always a need for logging in some varying degree to troubleshoot.
There are several threads on here discussing purchasing from C, A, BTC purchasing, and Monero purchasing. Do your own research and double check information people provide to you on the forum. I would encourage reading the Darknet Bible and looking at threads from JGM on how to convert BTC to Monero. Monero is inherently more anonymous than BTC. Some dealers do not accept Monero.
Edit:
@enjolras has a few posts where they breakdown how it is possible for police to track BTC transactions. If you're buying in personal amounts, it is unlikely these tactics would be used against you. These are mostly for hitting larger and more organized people.