If you have JavaScript and Flash running, you have much more to be concerned with than your MAC leaking. You could leak your real IP along with your ISP and even your geographic location if you have a GPS on your device. Ultimately, they're going to want to know your home address and true identity, so you'll want to protect all data that can lead to that.
Your device's MAC can be used to identify you if you connect to a public network such as McDonald's, so be sure to spoof it in that case.
Your modem's MAC is far more interesting than the MAC of any device in your home. Your ISP will certainly have your modem's MAC on record, since they'll need to whitelist it on their network. That MAC is only between you and your ISP, and your ISP can use it to identify your traffic. If you use Tor or a VPN, then your ISP can only see that you accessed the entry point, but not the exit point.
If your VPN connection is encrypted, then your ISP can't see what you're up to through that connection at all. Most exploits in this case require that you download and run software that can give away data such as your actual IP address through the VPN connection. This happens with torrent clients that's not configured correctly. The client actually sends your real IP address through the VPN, which makes the VPN useless. Another attack is to ping a server without using the VPN. That's why you should be careful what software you use through a VPN, and don't enable JavaScript or Flash.
You should also be careful of data that is cached or otherwise saved locally. You may do everything through a VPN, but that cached data could be used to identify you. That's why many use a virtual machine on top of a VPN. Our own Holla Forums saves your post deletion password locally, and it can uniquely identify you between sessions.
Consider that the owners of the VPN are human. They may give your identity away for any reason, including disagreeing with your politics, greed, fear, or it may be stolen from them. Don't put so much trust into them. Also, if the government is monitoring both ends of the VPN (and they likely are), they can know who you are. Try using VPN + Tor for extra security.
Web browsers can leak a lot of seemingly unimportant data, such as your OS, browser brand, and even the dimensions of the window. This can be used to "fingerprint" you. You can spoof this data, but there is some debate over what is best. Some say giving away no data is suspicious looking, others say changing it randomly each request is also suspicious. I prefer to set it to the most common to blend in. This fingerprinting can be used along with the time that you did something online to find you. I've heard of people being caught using Tor because they were known to be using Tor at the time an exit node did something illegal.
Best security I can advise is to use someone else's Wi-Fi, with a VPN, through Tor, with your Mac spoofed, no JavaScript or Flash, spoof average Joe user agent, taking care not to store any local data, pay for anything in cash. Use a VM if you want, but I don't think it's necessary if you're careful.
