Yes, AdGuard seems to do so and IIRC also has customizable block lists. The default includes Safari-only blocking but it is able to add a device-wide filter using Apple's API for VPNs. It seems to identify the various trackers used by the social media apps on my device, for instance.
Looks like system-wide blocking is via DNS, which would leak DNS requests to AdGuard's DNS server? The same could be accomplished with a local PiHole device.
