Sure, Calyx is a good choice too. Is there particular reason why you picked CalyxOS over GrapheneOS? Graphene has pretty much all of the features of Calyx and it even has better support for Google Play Services, as it just sandboxes them instead of using the microG reimplementation. That way, it passes SafetyNet checks and most banking apps work. It's also much more secure and even used by people like Edward Snowden, as it fundamentally improves the Android security model, by hardening the Linux Kernel, SELinux/SE for Android policies and using it's custom hardened memory allocator that was ported from OpenBSD.
Calyx is definitely much better than the Stock OS or other ROMs like LineageOS, but I think GrapheneOS is far superior.
DivestOS might work. In my opinion, it's the best ROM for non-pixel devices. You can also go with LineageOS, but it has some serious issues. It might be better to keep the stock ROM as long as it's supported and updated and to remove all the bloatware/spyware using the Universal Android Debloater. You can also use a Firewall like NetGuard to block internet access to certain apps and use a DNS Filter like NextDNS to block known tracking domains. NetGuard isn't perfect though, and it can be bypassed. The same goes for NextDNS. It's better than an insecure, unpatched OS though.