The NSA has unlimited legal power in this context. They can legally go to any US VPN, copy all traffic onto their massive servers, and use it as they want. They probably already do this, although that claim is unverifiable. That traffic contains your IP address and the websites you've viewed, clear data of torrents you've downloaded, etc. Mullvad, being outside its jurisdiction, is possibly safer, but presumably since they operate servers in the United States at least those could be sniffed. There is precedent for all of this.

While it's unlikely for you to specifically be targeted, my point is that you can never be truly anonymous on the internet.