It's impossible to have a full and complete list of VPN exit nodes, for the simple reason that no company publishes the full list, and also technically if you set up an OpenVPN server on digital ocean and connect to that you're also using a VPN but no one would know your address is hosting a VPN server.
So it would be possible if the state demanded that VPN companies provide adult sites with continuously updated lists of their exit nodes.
It also seems to me like Utah could just demand that adult sites only accept traffic from residential ips.