NEVER click decline all. There are loopholes built in that still grant access to "legitimate interest" cookies, which are recognized differently from "consent cookies." If you click reject all, it still allows collection of certain personal info through cookies labeled legitimate interest. Which is entirely up to advertisers to categorize.
As annoying as it is, always open up options and manually uncheck cookies.
With TCF 2.2 "legitimate interest" is no longer allowed (but that's probably only for IAB members). At our company we already had a rule where we disabled all "legitimate interests" from our vendors, so I assume there are other companies that do the same.