I also made a form that displays information for a city like a city's area and median age. I also made an API function to call from Mathematica at CloudObject["https://www.wolframcloud.com/obj/73c731cb-7afb-4b8b-ad06-509c3aab3dd1"]

The server uses the requesters IP address to decide which city to compute data for.

Yes, the geo location (lat/long), country, and city are determined in cloud by using a geo IP mapping that determines location from a public IP address. If the requester IP address is not a public address, there is no mapping, so the cloud sets these to a default location/country/city, which is that of the Wolfram company HQ in Champaign, Illinois for public cloud. For private clouds the default location is configurable.

I know the server has a static IP address but if people from different parts of the world queried the Wolfram Cloud API could it tell where they were?

The server static IP address doesn't enter in to the discussion at all. It tells where they come from using the IP and the geoIP mapping described above.

If things aren't working as expected in your testing with a VPN, you'd want to confirm that the request to the cloud is actually going through your VPN, and you'd want to see what requester IP address the cloud actually sees, and confirm that's what you expect.

What is "the API's geolocation"? Do you mean the geolocation where the servers run? You might think you could discover the cloud's location by making an HTTP from within the cloud to itself, but the networking there is going to use a private IP address (aka RFC 1918 address), one that doesn't have a GeoIP mapping. We do have a notion of a default geolocation for the server, but I don't think we expose it in a WL variable, it gets assigned within the web server and then passed to WL. We could do that, and there is precedence for things like that, e.g. $SystemTimeZone is the time zone the computer has before a user (or the cloud) started localizing it.

Is there a way to make a programmatic API with a default that could be executed with for example HTTPRequest in Mathematica that defaults to the API's Geolocation if no parameters are specified and otherwise if a location is specified it uses that instead?

Your problems getting the VPN IP to be picked up are a separate independent issue -- anything we talk about is going to use the GeoIP database. You can deploy this to check what IP and location is seen by cloud:

CloudDeploy[Delayed[{$RequesterAddress, $GeoLocation, $GeoLocationCountry, $GeoLocationCity}]] 

I asked the forms expert what the right way is to populate the field by default, which is to use the Input specification, like this example:

CloudPublish[
    FormFunction[{"country" -> <|"Interpreter" -> "Country", "Input" :> $GeoLocationCountry["Name"]|>}, 
        {"Country" -> #country, "Population" -> #country["Population"]} &
    ]
]

There should be, and I think there could be both a programmatic way to do it and a UI way. Hannah provided a technique to collect this through a form, taking advantage of the fact that GenerateHTTPResponse can nest the active cloud object expressions like APIFunction and FormFunction within the same rest (in her case, an APIFunction that returns a FormFunction). But I think a programmatic way to do it, probably through a query parameter, is also needed and would have to have support added in to the cloud back end. I've put this on our to-do list of things to add to cloud.

Awesome, nice to see this!

Yes!!! It's working. Thank you!

I now have a simple API that lets you enter a city and see basic weather data

CloudDeploy[FormFunction @@ 
  APIFunction[ "location" -> "ComputedLocation", 
   Grid[{{Style["Current Temperature", "Subsubsection"], 
       IconData["AirTemperature", 
        WeatherData[#location, "Temperature"]], 
       QuantityForm[WeatherData[#location, "Temperature"], 
        "Abbreviation"]}, {Style["Current Relative Humidity", 
        "Subsubsection"], 
       IconData["RelativeHumidity", 
        WeatherData[#location, "Humidity"]], 
       QuantityForm[WeatherData[#location, "Humidity"], 
        "Abbreviation"]}, {Style["Current Wind Speed", 
        "Subsubsection"], 
       IconData["WindSpeed", WeatherData[#location, "WindSpeed"]], 
       QuantityForm[WeatherData[#location, "WindSpeed"], 
        "Abbreviation"]}, {Style["Current Wind Direction", 
        "Subsubsection"], 
       IconData["WindDirection", 
        WeatherData[#location, "WindDirection"]], 
       QuantityForm[WeatherData[#location, "WindDirection"], 
        "Abbreviation"]}, {Style["Geographical position", 
        "Subsubsection"], FromDMS[#location], 
       DMSString[#location, "Position"]}, {Style["Current time", 
        "Subsubsection"], 
       DateString[Now, "DateTime"]}, {Style[
        "Geographical xyz position", "Subsubsection"], 
       GeoPositionXYZ[#location]}, {Style[
        "Geographical projected position with Bonne grid projection", 
        "Subsubsection"], 
       First[GeoGridPosition[#location, "Bonne"]]}}, 
     Alignment -> Left] & , "CloudCDF"], "versa"]