If a GTM container loads on a page but is not configured to fire any tags on that page, then the only request that will be made to Google servers is the one that loads the (empty) Container. While this request might end up in a logfile, the "interesting" data is limited. In particular, GTM is served from a different domain than any other Google properties so even third-party cookies couldn't be used to tie the request to your identity.

Not sure about OSS alternatives. I know of a few competitors (Adobe Launch, Ensighten, Tealium), but they're all commercial. I don't expect there's a large market, the key value proposition of tag management platforms is cutting down coordination overhead between the marketing and IT teams, and self-hosting is the opposite of that. However the trend towards first-party tracking may open a market for it.