I’d second this. The organization behind it (https://calyxinstitute.org/about) is a long established non profit, their portfolio covers various cool projects. The vpn client itself is basically a rebranded version of https://f-droid.org/packages/se.leap.bitmaskclient, it it is nothing special.

The question is not weather Google is tracking or not, the question is if Google is breaking the law doing so.

If you want more in depth control on google services, CalyxOS supports microg in various combos (https://calyxos.org/docs/guide/microg/#options-for-running-microg-in-calyxos). While it has some limitations compared to the official google services, it also allows better privacy control and is fully open source.