Every URL visited minimum unless you are going to an encrypted VPN outside their network first, then they will still see the network traffic to that vpn . I Know someone that got caught redditing on work wifi. granted they also had their device name set to use their name in it... so some of that is on them

As an IT administrator, if your org has GPOs controlling if you can delete your browsing history or not, there is no chance you will be able to install a second browser without admin credentials.

Same can be said for any browser, any app, any connection while on the employers network IF they wished to monitor it. Even if you were able to delete all local browsing history and used private browsing, your employer would still be able to know every site you visit if they wished.

If you've authenticated with your credentials on the device, IT is able to see IPs visited and DNS queries and has access to all sorts of network tools to track, shape and otherwise manage your activity.

It's best to assume that nothing you do on your employers network, even when logging into their corporate VPN from a personal device, is private.

I'm always shocked by privacy conscious people who do not have complete segregation of work and personal equipment and devices.