I use Wireguard and Tailscale. Some networks block Wireguard connections. Tailscale always works.

2 instances of Adguard Home (VM and Raspberry PI with adguard sync) using DOH upstream servers (currently Cloudflare, Quad 9, and Mullvad). Works like a champ, have not touched it in over a year.

No mention of software costs, ongoing software and hardware maintenance. There is no cookie cutter answer, it really depends on the specific systems.