If you have logged into and/or posted from your npub without using a VPN (every single time!), you will have broadcast your IP address to relays, apps, and possibly had it logged somewhere. If you have not scrubbed metadata from all images before posting, there is almost certainly identifying info embedded in those. Posting habits (GM!) will give away most people's time zone at a minimum.

Not to mention, most people willingly disclose plenty enough information just in their every day posts and conversation to allow someone with enough incentive to identify and/or locate them.

Plug someone's entire nostr history into an AI and you'd have an pretty easy time extracting something like npubX is male/female, has kids, lives in Europe, rides a bicycle to work, partner's name is Alice, etc., etc. Even things like license plates in images or the kind of trees in the background of a photo, specific buildings, etc. help to pinpoint locations and habits.

Basically one must be intentionally vigilant and careful 100% of the time if staying truly anonymous is something that is important to your wellbeing.