If you’re very technical and understand Linux, security, etc in great lengths (such as how to setup your own iptables rules with looking for help or creating your own scripts), and really know what your doing, a rooted non-gapps lineageos (optionally microg) is a great choice, as long as you install things like AFWall+ and such to lock it down a ton. Heavy emphasis on “understanding” what you’re doing here, since if you don’t, a rooted device could be bad on security.

If you’re not at that comfort level or have the time for that kind of stuff, GrapheneOS (unfortunately on pixel) is the best option.

If you don’t want to give Google any of your money, and you don’t want to go into the super low level system control with root, the best option is probably still lineageos with microg (or without if you don’t need push notifications for anything).