Anything with a CRT worries me because even if the exterior is well-protected, the neck is potentially quite vulnerable. Variacs may be similarly vulnerable depending on how they're assembled. One that I purchased was mounted inside a metal box enclosure with a nice analog panel meter. I asked the seller to open it and stuff around the toroid. When it arrived, I found old rags stuffed inside. Nothing bent.
Below is some general info on how I pack stuff for shipping when I don't have an original shipping container and/or inserts for it.
Inspecting the item thoroughly is critical to know what you're up against, especially for bits that stick out.
The primary inner layer of protection is lots of bubble wrap. If there are knobs to protect such as on a front panel, I'll cut the bubble wrap wider than needed and bundle it up for several inches of extra protection. Even if it gets a direct strike, the force will be distributed around the controls. If there is a significant amount of disparity in spacing and knob/post heights, I may apply separate bubble wrap in between to even things out before closing the main layers of bubble wrap over it.
The outer layer is the box, which is selected to allow enough space for the item, all its bubble wrap, and the intermediate protection layer. The amount of space allowance is larger for heavier or more delicate items.
The intermediate layer depends on the weight of the item. If it's not too heavy, I'll fill the space with air pillows. Amazon uses these, except they usually don't use them properly. Amazon will place the item directly on the bottom of the box and throw some pillows on top just to say they did something.
When I use them, the result is that the item is suspended on all six sides and immobilized.
For heavier items, I use packing bits. They come in all kinds of shapes (peanuts, cylinders, balls, etc.) and sizes. The important things are not to skimp on them and to settle the material as the item is being packed. Just throwing it in and closing the box because it looks full is about as useful as whipped cream.
Before finalizing the box with tape, I tack the box top closed with a few short pieces of tape and shake it in various orientations to listen and feel for any movement. It should feel like a solid block. There should be no indication that any object is inside. If necessary, add more stuffing.
When I head out to the shipper the next day, I'll shake the package again, just in case.
The biggest/heaviest item I've shipped was an HP 8591E spectrum analyzer (CRT display) without the protective front cover and the rear posts/feet attached. What a beast that was. It went cross-country unscathed.