> Tracking which devices still send lots of data when no one else is using the network?

That's what I personally do at least: I have nlbwmon [0] installed on my OpenWRT router to track data usage per device, then I scrape it every minute with Prometheus and plot it in Grafana [1]. This helps me see if any IoT devices are compromised, but it probably won't help much if people are using sketchy free VPNs on their phones. I also adblocking enabled on my router [2], which helps block a few malicious domains (but certainly isn't a panacea).

[0]: https://github.com/jow-/nlbwmon

[1]: https://www.maxchernoff.ca/files/grafana-network-bandwidth.p...

[2]: https://docs.mossdef.org/adblock-fast/