A bit late, but you might find useful information in this book: http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec. Not all of it might be relevant to you, i.e. you are probably not doing anything that would require plausible deniability, and probably some other things. But it has some really good info, in my opinion.

I don’t undurstand how Graphene can bigger than Linux on this list.

VPNs know who you are and what websites you visit, so no privacy nor anonymity there. With Tor… It’s complicated. That’s why we have guides like this: http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec.