It was a bit confusing when Roseanne and Kim Basinger had the exact same voice.
What happens usually is that a) copyright investigators (on behalf of copyright holder associations) or b) ISPs do basic analysis and "flag" IP addresses.
The copyright investigators usually look at torrenting pools, log all the IPs, and do some sort of query on those IPs (whois, reverse dns, etc). Then they pursue the biggest targets. "Hey, look, this IP that belongs to Meta has torrented 4234234TBs worth of our clients' data. Bad Meta". And the headlines pour.
Your local ISPs do basic inspection, and can see you're torrentig, but usually (unless they take extra steps) won't know what you're torrenting. But they can send a letter saying "hey, knock it off!".
If you're using a "proxy", either via VPN or VPS (seedbox) then your primary IP address never gets caught in these logs. So they won't be able to know who it was. Sure, they can go the legal route and subpoena the VPS providers, but that's where the "friendly jurisdiction" comes into play. Unless they get raided by said 3 letter agencies, they won't care much about an angry letter from a lawyer.
btw a representative of Leaseweb told me they don't do individual accounts any more - they're focusing on the European sovereign cloud transition.
Torrent to your heart’s content.
I actually browse full time like this; all traffic leaving my house via my ISP is VPN (or some limited exclusions that all use TLS).