Afaik, Plausible doesn't need a data protection officer. See Article 37 GDPR. (But I'll follow that up with them, in case it's an oversight.) I have read Plausible's documentation, and I haven't identified any problems with their practices.

Umami's homepage requires JavaScript to load, which is a red flag. And, as expected, there's something wrong: it's owned by a US company, which makes it a no-go.

Matomo is excellent and I second your recommendation.