i had the same problem till i configured private dns to “adblock.dns.mullvad.net”

How to prevent DNS leaks ☞ https://mullvad.net/en/help/dns-leaks

Even tho am using proton VPN (free) with private dns enabled

Do make sure Block connections without VPN is enabled. I know ProtonVPN had issues with leaks in the past, but it’s been resolved. I don’t know if it was only resolved for GrapheneOS devices, or ProtonVPN as a whole. You may look into Orbot if you’re willing to put up with the slow network speeds, to fully lock down any leaks from the VPN side.

dnsotls-ds.metric.gstatic.com this domain directly connects to my real isp and leaks my real location.

Where did you find this out? I’m assuming from your DNS provider, but which one do you use?

Am using private dns in order to block trackers in my bloated phone.

This is reasonable, but it won’t protect you if no DNS query is made in the first place (i.e. directly connecting to the IP address, rather than a domain name). In this case, however, it looks like it is creating a DNS query, but be careful because DNS based filtering isn’t magic. If you pay for ProtonVPN (or Mullvad VPN, which is a better VPN in my opinion) you can have greater control over what gets blocked.

Debloating is not an option for me as i lack a laptop and bootlocker is not unlocked, i tried many ways to debloat but all i can do is disable system apps

Thanks for the information, and that’s unfortunate. I’ve messed around debloating cheap Android phones, but you can barely scratch the surface from a user standpoint.

I don’t installed any proprietary apps even whatsapp or banking apps to never sent my data to them.

dnsotls-ds.metric.gstatic.com is a Google-owned domain, used for DNS over TLS. I don’t know much about it, as I don’t use a custom DNS provider, but check if your DNS provider is using Google’s DNS as a backend or a fallback. That may be where it’s coming from.

The issue is just system apps trackers. Am using ironfox with ublock and tor with noscript.

Check IronFox’s DNS settings, and set a custom DNS over TLS server, if you’d like.

Any way to prevent this vpn leak ?

Since you’re using a custom DNS, this likely isn’t a VPN leak, but more likely a DNS leak. If you want to simplify things, using your VPN’s DNS can help prevent misconfigured custom DNS solutions, so it reduces the risk of a leak. This will remove some of the filtering you have in place, though.

My threat model is to hide my traffic from isp as my isp is a spyware privacy invader.

It seems your threat model is hiding traffic from your ISP, minimizing telemetry, and using as much open source software as possible. If you prioritize only hiding traffic from your ISP, using your VPN’s DNS would achieve this, but there are known cases (especially on iOS) of the system bypassing the VPN and connecting directly anyways.

Best of luck!