For this to be true they'd either need their own trackers on every single website online (or be ingesting from those that do but at which point it's not Elsevier's tracking) or be have software/browser addon installed on the clients' system.
Only a small handful of companies have approached the near-ubiquity of webpage presence of the former that made cross-internet tracking a realistic scenario (see eg. past critique of Google/Facebook embeds) but afaict the only thing being interpreted here is a line in a privacy policy that is very likely being misinterpreted.
Certainly the report doesn't make any claim about ubiquitous internet tracking in its key findings summaries. Contrast that to how Fight for the Future has run with it:
> Elsevier tracks more than what books someone reads—it surveils readers’ search and browsing history across the whole web, collects their locations, and builds profiles based on inferences from this data.
I'm not sure where you are getting all that misplaced goodwill and hopes of lack of capabilities
If students were regularly installing a native app or a browser extension, the tracking claim would make sense, but neither you nor TFA have suggested a valid mechanism for the supposed tracking.
Am I missing something where it goes from reading Elsevier's books and using their site to making the leap to internet-wide surveillance?
From skimming through the SPARC report they cite it seems various findings are based on privacy policy language, one of which states that 'browsing history', 'search history' and 'interactions with our and other websites' may be collected, though this reads like it may just involve their own sites' analytics with only the latter involving other sites (which could be just outlinks but is unclear).
While the rest of the report seems to just cover some overviews of their own cookies and open-ended concerns about third-party scripts (which include general CDNs and their own analytics hosted by third-parties).