See: https://openwrt.org/docs/guide-user/services/ad-blocking
I use the regular adblocking in combination with DNSMasq works sufficient for my needs.
I use DNS over HTTPS for upstream DNS servers: https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq_https-dns-proxy to get secure DNS.
VPN has not much to do with this you are the one who specify the DNS servers you use not the VPN provider, although there are some who high-jack your DNS53 if it is send via the VPN