(devices that advertise mDNS as a server should also not communicate via unicast IP out to the Internet, block those kinds).

Looking at you, both HP and Epson printers. Buy a Brothers printer but without their “Refresh” option (Refresh is a dial-home leaky privacy thing).