I use GrapheneOS but also have a phone with divestOS for testing. The latter feels and acts very similar but you can’t use any Google Play Services.
On my GrapheneOS I have several user profiles for apps requiring Google Play. I keep those all in separate profiles so they are further isolated.
For data I use anonymous sims for and for calling I use a few VOIP providers for my phone numbers. My phone usually lives on WiFi and I usually keep airplane mode on.
I use both Molly and Signal. Not sure how you enabled auto updates in Signal @Niek-de-Wilde?
Have been using both Mullvad and Proton VPN. The advantage that Proton VPN has is that it doesn’t limit the amount of clients, rather the amount of simultaneous connections. That is very useful when using many user profiles with Mullvad you won’t be able to do so.
For browsing I use Mull in private only mode so that nothing is left behind after each session. I use mull to be able to use uBlock Origin as browsing the internet without it is a painful experience. That besides I strongly blocking ads from loading is the best way to prevent malware.
For calendar and contacts I use Etesync and for notes I use Standard Notes.
Navigation I do using Google Maps. I tried alternatives but I cannot live with them.
For RSS I use Read You. For podcasts I use AttennaPod, for video NewPipe x SponsorBlock.
I get my apps also using Aurora Store and Github. Currently testing out Obtainium to update my apps from Github.
For additional security I recommend the apps Sentry, Wasted, and Duress.