greetdnashoe Looks like I'll have to follow up with them since Private DNS won't work on an Owner and secondary profile at once on GrapheneOS
You misunderstand. As stated in the quote, Private DNS is (currently) global, meaning whatever DNS you set will apply to both the Owner profile and any secondary users you make. If you want separate DNS for each profile, then setting the DNS in a VPN would be how you separate them, as VPNs can be configured per-profile unlike Private DNS (also stated in the quote).
I believe that if you do it that way, you would also have to turn Private DNS off as that would override whatever DNS you have in your VPN apps. If you don't want/care about separate DNS for profiles, then you can set up Private DNS and it should work fine I think (unless for some reason, it doesn't).