My threat model is generally removing as much passive data gathering and tracking as possible, corporate or state. My threat model does not include active investigation from the law enforcement or state

Honestly just route your tcp traffic through Tor, even if you're being snooped on by guard and exit nodes owned by the state when using clearnet sites, no advertiser is going to know who you are, and state owned exit nodes aren't going to investigate you for visiting random common clearnet sites (note even if you're deanonymized you're still protected by tls). No reason to pay for a VPN for this, and the more Tor users the safer Tor gets against certain types of attacks.

It's worth noting neither a VPN nor Tor will protect you from advertisers fingerprinting you due to poor opsec; and that is very difficult to get around if you're doing something like using popular social media platforms with an account.