https://www.kuketz-blog.de/grapheneos-der-goldstandard-unter-den-android-roms-custom-roms-teil7/ This author made a series about custom roms (unfortunately only in German, but Firefox has a built in translation function) where he tested what data was sent in the first 24 hours of using the custom roms without installing any new apps or changing the settings. To summarize it: Most custom roms still build up a connection to some Google server (like a SUPL server for example) and some custom roms have rather bad security practices (like waiting for a month before rolling out security updates). GrapheneOS is the only custom rom that doesn’t connect to any google servers and has exceptional security (even better than Stock Android).