Use a VPN for everything except looking up Bible quotes and searching for grannie porn.

And, for the love of god and all that is holy, change the DNS on their modem/routers and use a secure DNS provider on a different device.

And check that your DNS resolver does esni / ech properly.

https://www.cloudflare.com/en-ca/ssl/encrypted-sni

Your results should look like this:

Addendum:

If you can, or if you know someone, or if you care enough to learn (I went from zero knowledge of DNS to "zero trust" in a modest amount of time), set up your own DNS resolvers or DNS proxies. Learn about things like DNS rebinding (bad), and how to prevent leaks using a VPN.

Personally, I use dnscrypt-proxy on Linux and android. It can be configured to use a local DoH server, quic/http3, DoT, and of course, dnscrypt.

Dnscrypt-proxy can use IP and domain block lists - no more ads, sypware, malware, tracking, porn - whatever category you want. It is compatible with adblock, unlock, and any other block list syntax. It also has the ability to forward certain domains to specific IPs. Eg someone looks up Facebook? They get redirected to 0.0.0.0 or why not lemonparty dot org.

The dnscrypt protocol both encrypts and anonymizes your DNS queries by relaying them through a series of relays (your_ choice of which and how many).