Definitely Android apps can use WebRTC, and basically any apps that do voice or video calling very likely do.

But more importantly, they don't even need WebRTC, because they can open up any sockets and communicate anything, unlike the browser that's more limited.

Like, any app with network permissions can just call out to any server, which will then have the IP of the client. WebRTC not required.

So yeah, you need all of the networking to go through a VPN to protect against this, if it's important to you.

Alway on vpn, block connections without vpn