Since when can you not spoof any of that? Grab a used android phone from local used market. Put any rooted rom on it. Spoof the gps… Device id is irrelevant at that point.

Starlink modules are not Android devices.

Device ids should be required for pairing with the satellite from my understanding. Same with IMEI on smartphones - except it should be useless to try to fake it as the number of devices is magnitudes lower than smartphones and it should be possible to pin-point any misbehaving device.

Spoofing GPS is not exactly useful. Starlink satellites are very low-orbit so again misbehavior should be detectable. I mean you can connect to some satellite but if you report location that should be served by a different satellite then you got yourself caught.

you can just order the starlink equipment to a random address in a different country

Starlink is shipping devices to Ukraine directly for the military it seems. It should know the difference between these and others that are shipped all over the world by anyone.

Once you got the connection up and running you just use a vpn to hide everyrhing.

VPN is out of scope for this I think. It's about locating the device physically by the provider, not about specific sites trying to watch actual internet activity.

they could do is block starlink for a whole region

They are already doing this but not the whole region. Occupied territories of Ukraine are selectively blocked according to their own availability map.