I have Spotify Premium Duo for son & I, Youtube Premium Family (I pay for son and I & got 4 of my friends to join so we split the cost), Voxa - audiobooks for son, NovelAI for son (some story writing tool I guess, to be honest I don’t really know what this one does exactly). No movie / TV show streaming services cause I have Filelist (torrents) and the world wide web.
OpenVPN runs just fine with self signed certs. No need to pay for anyone for that. Easy-RSA package even has nice scripts for you to run. Obviously that becomes a chore pretty fast if you need more than a handful of clients, but maintaining those for yourself and your spouse and kids it’s easy enough.
And, assuming you have public IPV4 address on your internet connection, you can use dyndns service and run all of that on a raspberry pi (or almost whatever you happen to choose). OpenVPN with mobile devices is a bit more challenging, but you can run OpenSwan for IPSEC or some other daemon as well, which might work better for your use case.