I don't use a VPN as I'm pretty sure my traffic identifies me once it pops out the other end. But I do tunnel DNS with a server I trust so that my ISP only ends up seeing encrypted traffic (DNS over ssh, and HTTPS). I don't do DoH because there are only a few providers and so those are hotspots for espionage.