Depending on your threat model, if you know your ISP is tracking everything, then a reputable VPN doesn't add risk. If you have guaranteed observation and recording at your ISP level, which is most people: then using a VPN, paid with cash or crypto, probably gives you more privacy. At worst case it's the same level of observation.

In your scenario, using a browser with encrypted hello, using fully encrypted DNS, the only thing the ISP would see is your connection to the web server. If that web server, like cloudflare, serves multiple things, then it may obscure who you're talking to.

That being said, if somebody is observing enough of the network, they can look at network traffic flows, and determine what other service you're actually speaking with. IE unique traffic patterns to play a game, watch a video, interact with a app. Those can get exposed by the size of packets and frequency of packets transiting.

The main difference between a VPN, and an encrypted socket, for traffic flow analysis, is the VPN traffic gets all lumped together, so a third party doesn't know which pattern belongs to which stream. So if you're streaming videos, well doing other stuff on the VPN, it becomes harder to identify your traffic flow.

The browser traffic flow analysis is much easier, because each individual stream of data is observable by the ISP.