These are some interesting starting points to cover
broadcast-intents: which are handling wifi, bluetooth and basically any global action targeting different android apps and services -> we need to monitor for phunky looking traffic
Network traffic analysis, which could be interesting to monitor when starting to make the firewall rules more lax
Accessibility Service: which logs/responds to all events happening in the device - might need to right a writer android app (not sure how viable at the moment, but would be interesting)
logcat: monitor system level logging, which is the simplest way to solve in-device logging
These are some interesting starting points to cover