I hear lots of great things about Graphene but it's only able to run on Pixel phones. I have a LineageOS installed on my phone & I have full control over the firewall, and there's no google on it. Got the phone a year ago, battery still lasts 2 days of occasional use. It's amazing how nice a phone feels without ads, constant upload/download, and unneeded background services running.
Basically, and even with Graphene, the biggest security risk for a phone is the person using it. I wish it were more turn-key but the tracking with cookies is just the tip of the iceburg.. apps like to track too and if you need an app outside of the free-open-source-software circle you should know how to control its access to the internet.