I do like to run tcpdump regularly. For a while I ran my home laptop thru an allow-listed proxy, and I was quite surprised at the results, and how little I had to allow to get what I needed done. A lot of software is phoning home. I would have thought that open source folks didn't do that, but standards or expectations have shifted. A browser that took over your DNS would have been anathema in the 90s, but now we trust the local networks even less.
Do you manually inspect every CPU clock cycle spent, or every data connection or packet sent by every piece of SW running on your system, to make sure it was all done with your consent?