Commercial VPN services can worsen privacy (although their marketing claims otherwise). You've now added a second government, second downstream ISP, second DNS

Commercial VPN services can worsen privacy (although their marketing claims otherwise). You've now added a second government, second downstream ISP, second DNS provider, and then of course the VPN services themselves (in particular with the race to the bottom pricing, and the potential for break-ins). But in answer to your question: Encrypted non-ISP DNS (via DoH (DNS over HTTPS) ideally) and then HTTPS wherever possible. Most of the really constructive things you can do for privacy improvements are at the browser or OS side though. For example Multi-Account Containers, Facebook Container, uBlock, etc.