Unless you're intentionally exposing inbound traffic to your LAN from the internet, pen testing really isn't necessary. Your default firewall settings would be enough to protect you from that angle.

You can run vulnerability scans and look up best practices for your router settings, but really most modern OSes are safe as long as you follow basic common sense like not downloading and running sketchy software, even on Linux. Just keep everything updated. Even Windows Defender is sufficient as long as you're not dumb about it.

If you're talking about remaining anonymous online, that's an entirely different, much longer conversation.

Same with keeping your internet connected devices from spying on you.

But without knowing what your attack surface looks like, none of us will be able to provide a very detailed answer.