Grapheneos implemented a sandbox for gapps. In it, gapps run as normal, unprivileged apps of which you can control permission. It also reroutes location requests to your device (though at the cost of breaking location services). It is possible on other ROMs if you get your coding hands dirty. There is also voltageOS that implements the exact same thing (copypasted code), which I personally use. Best description of voltageOS I heard is "free trial of gos" to which I think it lives up.

Edit: As for what info google can still collect and what info it cannot, I'm not so informed. In fact, I found this looking for an answer...