datlee There are many ways to track a user between devices. Looking at your scenario, your IP address could definitely link your two devices together. This requires your email provider and the websites you visit to have the same trackers. (Google Analytics for example)
A VPN while using your email service/web browsing could be a solution. GrapheneOS allows you to use different VPNs per profile/user.
I would like to also point out that sandboxing is a feature already in AOSP and not GrapheneOS specific. From my understanding, it is more of a security feature than privacy feature. Just look at sandboxed Google Play Services as an example. It is sandboxed like any user app but that doesn't stop it from being able to communicate to apps that consent.