Pi hole, and similar, and block all other DNS, would probably be a good start. Tackling on edge firewall, looking what goes through, and blocking it there is s

Pi hole, and similar, and block all other DNS, would probably be a good start. Tackling on edge firewall, looking what goes through, and blocking it there is second step (but since a lot of it is going to various cloud providers and cloud flare) this is often not an option