I respect your efforts.  However, you will find yourself in a position where u eventually inadvertently dox yourself by having KYC and NonKYC on the same device. 

Dual users , work/personal profile....its gonna happen. Then all that work to keep the two separate will be fucked. 

Get another phone for KYC stuff and keep it in a Faraday bag when not needed. 

Have two seperste SIMs and don't ever connect the NonKYC phone to your home KYC/IP. Unless you setup a dual SSID system at your home.  

One SSID exits on clearnet.  The other exits over say a VPN you've acquired with anonish money.  

My experience, use pfsense as the router. Configure two interfaces. One of the two should have an always on connection to say Private Internet access (or whatever u want VPN) then configure vlan and assign that SSID to the vlan that sends all that NonKYC traffic through the VPN.  You'll need a switch and Access Points that support such tech. Ubiquity and or TPlink support such.

A plus to having pfsense at the head of your network is u can now connect to it over VPN. Then, ideally u can set your KYC device to always on connect to your home and then all your KYC traffic exits from your home IP. 

I know that's a lot to digest and it is a bit of work but its worth it. 

It also transcends any future devices u may acquire.