NextDNS doesn't send the traffic, just DNS (and, entirely encrypted via DoH, unlike normal DNS), but if you're concerned about it, something like pi-hole does much the same thing, and is self-contained/self-hosted.

I deployed a VPN+PiHole on a micro ec2 instance for use from my iOS devices. Works great. First i installed pihole and configured, then used this https://github.com/jawj/IKEv2-setup to setup the vpn. Took about 30 mins. Works great!

I have PiHole as well. How to verify that FB SDK requests are blocked by it?

Why do you trust AWS more with your traffic than an ISP?

Because AWS is going to have to answer to pissed off Enterprise customers if there was ever a story to come out that they're handling customer data inappropriately.

For me the value is more about having ad blocking at the dns level and the vpn is just a way to get that on iOS/Android devices where I don’t control dns servers. When out and about on 4G, pages load a lot faster with all the garbage blocked.

If it's not open source how do I confirm that for myself?

Agreed. I’d pay for a service that was a. open source and b. configurable to work with my own machines.