Let me split up your questions and hopefully it will make sense... When I use my VPN (ExpressVPN) connecting to a site that use only http, is that something i need to worry about? A VPN is an encrypted tunnel between your computer and the VPN end point, in this case the ExpressVPN servers in the country you connect to. Any internet traffic is therefore encrypted (people could intercept it but wouldn't be able to understand it) until it exits at the ExpressVPN server. One advantage here is that even if people (governments, etc.) are monitoring what comes out of the ExpressVPN server you connected to, they won't be able to tell that it was you that sent it. Just that some traffic has emerged.
As noted by someone in the comments (thanks!) - any traffic to http sites will be visible to someone monitoring. So while the source of the traffic will look like the VPN server, the traffic itself could contain info to tie it back to you (e.g. names, ip addresses,...). One obvious use of VPNs is to access region locked content in other countries as the content provider thinks that your computer is actually in the same country as the ExpressVPN server you connected to. Let's say I talk to someone on a site that only uses http, will the messages be easily traced back to the sender? What is the difference in privacy/security when connecting to a website that use http vs https when I am already connected to a VPN server?
Let's take VPN HTTP connections first... if you are connecting to a https site via a VPN then communication is still 'further encrypted' between the ExpressVPN server and the https site. i.e. effectively encrypted the whole way from your computer to the https site but going via the ExpressVPN server. If you are communicating with an http site then someone could be intercepting and reading the connection of the traffic but would only really be able to tell that it was coming from the ExpressVPN server and not from you or your computer. So you are probably okay. However, if that http site requires a login and it is poorly designed it could link your message back to you if you have previously logged in without using the VPN.
The explanations above are quite simplified and there is a lot that could be discussed about the various encryption technologies. Another important consideration is whether your VPN logs what you do. Most good ones don't. There are various VPN ratings pages you can find including this one from the EFF in 2013 (couldn't find a newer version but I only looked briefly) which will tell you more about what your VPN does and doesn't keep track of. If your VPN logs your activity then they could be passing it on to others or selling it. General rule of thumb is that if you are using a free or very cheap VPN then the price you are paying is your privacy - they are likely making money from selling on activity details. A lot of people don't care about this as they just care about accessing region locked content. P.S. For what it's worth, I'm in the UK and with the passing of the 'snoopers charter' I won't be doing anything without a good VPN going forward as our ISPs will be required to log all activity metadata which will be searchable by ANY law enforcement official (including my neighbourhood policeman) without a warrant!
