Appreciate this will be coming from a place of helpful positivity but where security and privacy are concerned please bear the following in mind:
First, any OS or "Custom ROM" (unfortunate common parlance misnomer) that doesn't provide a locked bootloader as a minimum should not be considered private or secure and neither should rooting a device.
Second regards GrapheneOS and possible alternatives you mention...
GrapheneOS and CalyxOS are much different. GrapheneOS is a hardened OS with substantial privacy and security improvements:
https://grapheneos.org/features
CalyxOS is not a hardened OS. It substantially reduces security. It recently went 2 months not shipping standard security patches.
Compatibility with Android apps on GrapheneOS is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer:
https://grapheneos.org/usage#sandboxed-google-play
Can run the vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the problematic microG approach.
CalyxOS is closer to LineageOS they both share the same issue above and they both always use multiple Google services too while giving them privileged access even if users don't use microG. It would be wrong to imply they don't use Google services. microG is of course an implementation of Google services. GrapheneOS doesn't use Google services by default.
To clarify further they always use Google services even without microG. They use Google for connectivity checks, network time, attestation key provisioning, SUPL, DNS fallback (LineageOS only), PSDS (Pixel 6 and 7), eSIM activation and more enabled by default.
https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/ is a 3rd party article explaining some of the substantial differences between GrapheneOS and CalyxOS. It's a common misconception that they're similar. CalyxOS is far more similar to LineageOS than GrapheneOS. There are many other alternate OSes available.
https://privsec.dev/posts/android/choosing-your-android-based-operating-system/ is another article about privacy and security differences between alternative Android-based operating systems.
It also talks about other more plausible alternate operating systems such as DivestOS. Unlike most/a lot of content, these are based on real experience and technical details.