DNS and Certificates are the key: You should remove all CA certificates installed by software that show like it were "installed by you". Some AV software does

DNS and Certificates are the key: You should remove all CA certificates installed by software that show like it were "installed by you". Some AV software does MITM sending you a "trusted" certificate signed by their own CA whilst acting as a proxy between the actual site and the AV. Theoretically anybody could do the same on the network side transparently. Also if you don't trust your ISP, you shouldn't use their DNS servers. I don't know about commercial integration between DHCP and DNS requests to track people but it is feasible with some work. For DNS just grab a raspberry pi and setup a dns resolver. You only need the right root zone seed file. Just don't make it available to the whole internet.