How exactly does a VPN protect me from an ISP ? From what I know, all of my traffic passes through the ISP and into the VPN server. The ISP is in between us. Or have I understood incorrectly ?

From what I've read on the internet, a VPN creates a "tunnel". I don't really understand the tunnel analogy. Does it mean that the data is encrypted ? If it is encrypted, where does the encryption occur ? Is it locally done on my device ? Do the VPN apps perform this encryption ?

Also, what books would you recommend to a guy who wants to start learning about computer networks and how they work ? Are there any prerequisites to this topic ?