The following chapter from Lightning Provacy goes into some detail on what data routing nodes and LSPs can log: https://lightningprivacy.com/en/routing-analysis

I don't know of any analyses about the privacy implications of NWC. I suppose a relay could log how often you communicate with your node via that relay and what size your messages are, which may sometimes tell them what command you are using.

Hmm...I think this would be easy to mitigate via message padding, which should be quite practical because NWC messages are just enceypted json, so you can add fields that don't do anything and pad all messages to a fixed length with no downsides. Hey, I think that's a pretty good idea. Thank you for making me think of it!