TrackStop has a number of filters (even a Google one), so, what about adding a Windows Telemetry Filter to it? AdGuard has such a feature since release 7.5 beta (8 monthes ago). It's well known that using host file is not an efficient way to block windows telemetry, because some ip addresses are hard coded. Some have even conjectured that windows telemetry could bypass windows fw rules. Blocking them at the Vpn server itself (which doesn't run on windows) could be a good way to proceed.