As cybermech said, you basically will need to setup two VPN systems to accomplish what you want.
The EdgeRouterX can be configured to create an outgoing (OpenVPN) connection to one of the PIA servers, and then route all (or certain) LAN traffic that is destined for the internet through that "tun" (tunnel) interface instead of directly to the "eth" interface that your cable modem is connected to.
The EdgeRouter X can also be configured to act as an OpenVPN (or L2TP) server, so your phone/computer can establish a VPN connection back to your home LAN just like it does to PIA. You will need to make sure your cable modem/router is in "bridge" mode so that the public IP is passed directly to the EdgeRouterX, and if you have a dynamic IP address, use a Dynamic DNS service that the EdgeRouterX can keep updated.
Generally, there isn't a reasonable way to use the PIA connection to tunnel back to your LAN (for the typical PIA user, this "feature" would be considered a security risk).
Also, probably unlikely that you could use your phone to connect to PIA VPN first (to "anonymize"), and then establish a second VPN connection through PIA back to your LAN. You probably would want to leave your phone connected to PIA, and then disconnect and connect to your home VPN instead when you want to view your cameras. Theoretically, you should be able to set your phone to route all traffic to your home VPN when connected, and then configure the EdgeRouterX to route all "internet" destined traffic that comes IN through the VPN server tunnel back out through the PIA VPN tunnel. Your needs may vary, but that would be secure enough for me.
I wouldn't recommend port forwarding to any device other than a VPN server. It's still possible that someone could exploit a security hole on your router or the VPN server, but it's better than having a dozen different random devices that anyone on the internet can probe and try to compromise as a way into your home LAN.
FWIW, you can do a lot with the EdgeRouterX but prepare to spend hours/days/weeks searching the Ubiquiti forums for general direction and then trial-and-error at the CLI until you get it working for your particular setup. There are also broader considerations that you have to think through (e.g. if you're trying to force all outgoing traffic through PIA: where are the DNS requests going? what happens if the PIA connection fails and you don't know it, did you add a black hole route or is it just defaulting back direct to your cable modem? etc). It may be more straightforward to look into a router with Tomato or DD-WRT firmware that has web GUI configuration for some of these more advanced but somewhat "typical" uses and PIA provides instructions/support for configuring.
