phonehelp Privacy-wise what is going on when I do that?
Not so much i guess if u just had to click a button (probably just terms to use it), they might have saved your mac address which isn't an issue on graphene unless u manually have set that option to not randomize it. If u had to log in with say a gmail account that's another story.
phonehelp I always use a VPN, does that help?
Yes, certainly on 'public' networks.
phonehelp Is there anything Graphene OS does in this case to mitigate the situation?
Yes, randomize the mac address. I believe per network u visit there is a randomized mac address. There's also an option to do this per connection.