With the NSA's whatever the fuck they want budget, nothing's off the table. Dark web, Google, Microsoft, probably whoever will sell it and then they probably slapped them with a gag order If they're an entity likely to publicize it.

My pi holes are set up to pull dot and doh, but they still have to get there traffic from a provider. I should probably funnel that through my VPN but making my DNS unpredictably slow doesn't sound like much fun.

I'm sure ISPs will sell whatever they can see. Smart TV manufacturers use some crazy database to be able to detect what you're watching You know that's going off to everybody that would give them a $20 bill. Then anywhere where you've used the same email to sign up for multiple services all those services will be more than happy to sell their data.

Your bank, LexusNexis with credit data, your school, All the places that your parents and your kids use.

It's not that hard to use a password manager and a catch-all email and start diversifying your user accounts.

Tour and VPN start to degrade your service quality.

Using open source browsers and anonymizing as much as you can is good and yes even DNS over HTTPS plays a role in reduction.

In the end though, I wonder how much it really matters. If they just get one or two chunks out of that list, how much are the rest of it do they get for free or cheap. If you had the eye of sauron on you and they were really trying they would know everything you do.