Why not? I'm running vanilla AOSP with F-Droid apps only. No Google Apps framework.

Threats are limited then to regular baseband radio issues. I know I could be doing better if we had open hardware, but that's the most practical solution I can implement today I think.

That does solve the tracking issues, parent assumed you flashed OpenGapps w/it.

You can also run microG (LOS + microG I recommend; what I use on my smartphone) which contains UnifedNlp for location services.

Vanilla AOSP still use Google DNS by default and Google servers for an internet connection checker.

I patch that, and a few other things. It's a poor man's CopperheadOS.

Have you considered writing a guide on how you do this and what changes you make? I also own a Pixel, but kept running into problems when I tried to compile Android, eventually making me give up.

There's great work around from many people. See e.g.: https://github.com/dan-v/rattlesnakeos-stack

That's a whole toolset to compile your AOSP in AWS and then build your own over-the-air updates.