I often see wireguard and adguard or pihole mentioned. There's a service that provides a combination of wireguard and pihole in 1 docker compose file and has a web interface for wireguard clients (wgeasy) called wirehole. Been using our for 2 years or so, very happy with it.
In my opinion the most elegant solution for an ad blocking VPN.
I think a lot of people run opnsense, pfsense or similar.
So, run some sort of DNS blacklist on their home network, and wireguard into their home network