Well it isn’t really that hard techznically, but you have to be really sure it actually works and that’s the hard part.
You can look into “Gluetun”. It is a small docker service that supports PIA. You will have to put this and the rest of the ARR stack into the same “docker network” and configure it so that radarr, etc. go through Gluetun and use it’s VPN.
You can then open a terminal for the radarr container for example and run curl ipinfo.io for example to check the IP adress that container has to the outside world.
I didn’t do that whole gluetun setup in quite a while so i’m not really in the position to give a proper guide on how to route your docker containers through it. But there are guides out there that will definetely help.
Testing that it’s failproof would be for example run while sleep 5; do clear && curl ipinfo.io; done which shows your outside world IP for that container once per 5 seconds. Then stopping that gluetun container and look if the radarr container stops the ping and / or suddenly shows your real IP.
EDIT: found a quick readme for the gluetun container that shows how to route other containers through it