Regarding logging, you don’t know but the node doesn’t know that it was the first node to receive a transaction.

If you are communicating directly to the node.

Infura, on the other hand, uses a load balancer so it receives transactions before they hit their nodes, which means that server can assume it was the first to receive.

If you are operating on clearnet then you need your own node for privacy.

A TorOS lets you do this on darknet just fine though, its some random onion or exit node IP.

They can't do a man in the middle attack because the transaction is already signed with your private key and they don't have that.