The weirdest choice at the moment is by default Kagi sends a referrer when you visit a search result. There's currently ~65.000 Kagi subscribers worldwide, so just that lone data point completely destroys any anti-fingerprinting you're doing. And probably these subscribers are divided among time regions, so not all are active at the same time.
Even if you are on a VPN and visit site #1, then site #2, you are already cross-site trackable because it is very unlikely you are on the same VPN vendor (and endpoint) as the other subscribers. If you add in more data points like browser, OS, screen size and the like it becomes even more grim.
They have the referrer enabled because it helps make admins aware I guess.
You can turn it off (Settings > Privacy > Hide Kagi referrer), but defaults matter.