I’m not seeing substantial battery issues with the OpenVPN Android client I’ve been using. Sadly, they’ve switched to a support-all-protocols / subscription model. Better battery life using TAP rather then TUN. I still have access to the old version (log in to play store / accounts / history). This only works for apps that have also changed their names — otherwise you’ll get the new one. One of the reasons I root devices is so I can revert applications if I have an issue with an updated version (Titanium Backup if it’s within a week or two of the change, otherwise an archived Nandroid (bare metal) backup, which admittedly is a PITA).

I like the way Open VPN / TAP can keep a connection up even over cell tower handoffs, switching from mobile to wifi, and back.

Both piHole and pfBlockerNG block via DNS. You can expose just DNS to the internet (only allow requests, so less problematic) and then route those requests to pi/pfB. The real question is whether you can set your DNS server in a non-rooted Android device…?