My workaround

Just like you, my first suspicion was on the GFW and I set up my hosts file like you did.
ping success with and without VPN, which means there is NO connection issue between our computers and the domain.

Since there was almost no waiting time when my console emit the error messages,
it really didn’t feel like a timeout error.

secure TLS connection in the error message got my attention.
Is there a way we could modify the endpoint URL to http protocol?

Luckily yes:
hardhat-etherscan | Ethereum development environment for professionals by Nomic Foundation

I tried the following:

etherscan: {
  apiKey: {
    rinkeby: ""
  },
  customChains: [
    {
      network: "rinkeby",
      chainId: 4,
      urls: {
        apiURL: "http://api-rinkeby.etherscan.io/api",  // https => http
        browserURL: "https://rinkeby.etherscan.io"
      }
    }
  ]
}

Then everything works with and without VPN.

Source From: Lesson 6: Verify contract fails behind China Great Firewall / GFW with ECONNRESET · Discussion #2247 · smartcontractkit/full-blockchain-solidity-course-js · GitHub