Yes, GrapheneOS is Android (it’s AOSP without Google Play Services and GApps, with open source replacements). It’s like what CyanogenMod was back in the day. I haven’t used Graphene; I’ve never owned a Pixel. And Graphene is only on Pixels.

I’ve used a ton of Android custom firmware… from around Ice Cream Sandwich through Lollipop — back when Android was named for desserts. My favourite CFW was LiquidSmooth based on Jellybean, based on AOKP, which was an AOSP fork that tried to be “cool.” It wasn’t quite as cool as Paranoid Android (which was fucking awesome), but it was way more stable. And CyanogenMod was the most stable but “boring” by comparison. I mean it wasn’t flashy. But LiquidSmooth was rock solid. So no, I haven’t used Graphene, but I’ve used forks/ROMs like it.

If Google Play Services is running on it, and you’re not blocking it with a firewall (not sure if you even can, but I suppose it isn’t impossible), then yes, it’s spying on you. (I do not think GrapheneOS runs Google Play Services.)