I have a stack in place built around Tailscale. I mean, this may not be the best route but, hey, it works for me.
So I have Tailscale running across my devices. Within Tailscale, I have enabled Mullvad Exit Nodes for some privacy control. Then I have overridden the default DNS setting with NextDNS.
Within NextDNS I have a standard profile with some ad and telemetry blocking which is typically for the family devices and then I have a disgustingly pimped up profile for my main devices with a hell of a lot blocked, including domains that I do not care for (facebook for example).
The pros are that I can control all connections easier, even when out of my home network. That said, it takes some setting up to ensure I don’t bork connections. And, yes, I learnt that the hard way when I blocked all ‘meta’ tools across my whole network and the kids lost it!