dasaint100 Just trying to find the most secure way to use phone in public. Whether in public WiFi with or own sim router connection. With airplane mode.
Criminal hackers aren't really in the business of breaking into phones in public places, largely because it's inefficient -- they need to go to the public places, which takes effort and potentially exposes them to being caught. Criminal hackers would vastly prefer to stay home and use mass attacks against the unwary via web sites, SMS messages to random numbers asking people to install malware, etc. (see recent example). I am not claiming there is zero hacking risk on public Wi-Fi, but if you are using GrapheneOS and a VPN and a modern browser like Vanadium (that will warn you about non-https connections) you are in pretty good shape against random criminals sharing your public Wi-Fi trying to attack people -- assuming you run into such a person, which it's unclear you would.
Public Wi-Fi used to be much more dangerous (say, 10 years ago), but modern endpoints, especially iOS and Android, are much more careful about threats posed by local network actors.
dasaint100 What steps can I take to stop tracking through any means?
Criminal hackers aren't really in the tracking business. Meta is in the tracking business, Google and Apple are, even arguably PayPal.
Cellular carriers are inherently in the tracking business, and sometimes they have sold the information they've collected to shady people. Maybe some of them are doing it right now! But for most people it's hard to just stop using cellular networks.
Governments often like to track people, but you said you're not particularly worried about that.
Sometimes somebody decides to track a particular person for a particular reason -- maybe a vengeful former spouse. If somebody hired a criminal hacker to track you, then it would make sense to worry about being tracked by criminal hackers, but this is not common.
Honestly I think the risk of criminal hackers attacking you via public Wi-Fi (or via cellular-modem exploits) is much lower than the likelihood of criminal hackers attacking you by phishing your passwords or tricking you into installing malware. And I think the risk of criminal hackers tracking you is genuinely very low.
The situation is different if you have reason to believe that somebody is willing to spend genuine time, effort, and money to attack you in particular. If a nation-state or a criminal gang decides to get you in particular, to track you in particular, to figure out what kind of devices you in particular are using and which software releases your particular devices are running, and to deploy expensive zero-day attacks against you in particular, extensive measures may be necessary.
Just my opinion!