I want to boot the RPi 3 and run the OS from a write protected USB Drive to protect the operating system, then start a VPN client so that mobile internet access is reasonably secure. It this possible?
It's possible, but it may be difficult, depending on the operating system. Note also that, unless you're using a USB drive that features its own (hardware) write protection, merely configuring the OS not to mount writable filesystems does not mean that an attacker who gains enough access can't re-mount the filesystems as writable. You should also note that the write protect tab on SD cards is advisory only.
On the Pi the most commonly used OS for VPNs and many other networking tasks is Raspbian, which is a variant of Debian Linux. A very large number of components in most Linux systems rely on being able to write to the drive; the two chief uses are to save transient data (such as DHCP leases) and to write logs. Without the former some fairly important software (such as the default DHCP client!) will simply not work; for the latter you may be able to hack the journald configuration to live with no logging to disk but it's probably not trivial, and not everything goes through journald.
You'd also, of course, need to be able to restart the system in read-write mode any time you needed to reconfigure anything (such as changing VPN passwords).
If you really want to go with an entirely read-only OS, something other than Linux is probably what you want. (At least, something other than "regular" Linux. One of the router/firewall distributions may do what you need.) If you're going to use Linux, using a fairly strict SELinux profile is probably the most practical way to substantially decrease the risk of a system being compromised by attacks on its servers (as opposed to its users).