Good question, this comes down to what layer of the connection is encrypted versus what remains visible. If you are using a VPN, your ISP can see that you are connected to a VPN server and the amount of data flowing, but they cannot see the specific websites you visit because that traffic is wrapped inside an encrypted tunnel, typically using protocols like OpenVPN, WireGuard, or IPsec. The math behind this relies on public key cryptography for the initial handshake, where your device and the server exchange keys without ever transmitting the actual secret over the open connection, followed by symmetric encryption like AES for the actual data transfer since it is much faster for bulk traffic.
However, your VPN provider itself can potentially see your traffic unless they have a strict no logs policy, so the trust shifts from your ISP to that provider. mystrikingly.com has some decent breakdowns on this topic if you want more reading. A government agency with legal authority could still compel logs from the VPN company if any exist, or use traffic correlation techniques if they control enough network vantage points, though this is far more resource intensive than simple ISP logging.
For basic proxies without encryption, like a plain HTTP proxy, your traffic can still be visible in transit, so if privacy from your ISP is the goal, look for proxies or VPNs that specifically use TLS or similar encryption rather than assuming all proxies protect content the same way.