I gave it a punt and it seems to be OK. Below is my VCL. It basically unsets all cookies unless it’s wp-admin. This will only work for a very simple site.
# Specific to my.website.com
if (bereq.http.host == "my.website.com") {
# Strip all cookies (the only one should be PHPSESSID) if not admin
if ( ! bereq.url ~ "^/wp-admin/") {
unset beresp.http.Set-Cookie;
}
}