In my opinion the best way to do it, albeit quite time consuming to setup, is to setup orgmode with extensions such as org-ref, pdf-tools and org-brain. It is a big hassle, however I see it as do-once-in-a-lifetime (and iterate till infinity) kind of setup.

The possibilities are virtually limitless, the only minor (depending on what you want) setback is that the notes are "plaintextish" and separated from pdf (I see that as benefit but YMMV). There are interlinks between the text and org files, but the comments are not "in" the pdfs if that's what you looking for.

I can't provide any links at the moment but you will find many examples looking at the blogs. Be aware org is borg and consumes all information in your life ;). Fortunately it's as local or cloud and as encrypted as you make it.