For example, if I use my ISP DNS and open this page they will see:
https://security.stackexchange.com/questions/ask
It would show up in their logs for sure.
But if I use Google DNS, then what EXACTLY can they see?
Do they log this as:
http://204.93.58.117/questions/ask
or just:
I'm asking this because my government seems to monitor too much. I know about VPN but I don't use VPN all the time. I simply want to know what can ISP log when I'm not using VPN, only Google public DNS.
Short answer: they are only able to log the hosts you visit (e.g. security.stackexchange.com, google.com, etc) and not the full address (e.g. https://stackexchange.com/login). If you access unencrypted webpages (http instead of https), they are able to see everything. ISP are not known to log unencrypted webpages en masse, but I wouldn't not be surprised if the NSA or china logs this kind of meta information.
Long answer:
Since DNS traffic is not encrypted, your ISP could see every host you visit (it does not matter if you use Google's DNS or theirs). If you visit https://security.stackexchange.com/questions/ask (note the s after http), your ISP will see that you visited security.stackexchange.com and that you used HTTPS. If you use HTTP, the will see everything (the content of the webpage, url, and sometimes even cookies. Note that security.stackexchange.com will always redirect you to their HTTPS version. This means your ISP will only see that you were redirected to the encrypted version. If you are not on the https version, you're being MITM'd. You should then use a VPN).
If you request http://security.stackexchange.com/questions/ask (as you have originally asked), your ISP will also be able to tell that you requested the very page since it is not encrypted. It does not matter that Stack Exchange is redirecting you to the encrypted version because the you have already access the unencrypted version once. Make sure you always use https when possible.
If you access google via 216.58.192.110 (one of their IPs), your ISP will still be able to see that you visited 216.58.192.110. Since your ISP is also probably running a DNS server, they could also check where 216.58.192.110 resolved to (which will probably return google). They could also check that by hand, but this would take more time.
The only way to protect you from these attacks is if you use a VPN. Note that by using a VPN you simply shift the trust to someone else. If you use a public VPN, there are many more parties who can monitor your traffic: the VPN provider (their server might log everything you do), the server host, and the government the server is located in.
An ISP is literally an "internet provider". As such they provide you the wires and equipment to access the global scaled network.
Since they are in between you and the rest of the world, you have to assume that anything not encrypted is potentially logged by your ISP. Even if you use Google DNS, the DNS request will be send from your computer, to your modem, to an equipment of your ISP, then to Google DNS.
DNS is not commonly encrypted and contains the name of the site you ask for resolution, thus they can log it. Furthermore, IPs can be passed through a reverse DNS which will return the name the IP is associated with (actually the main name).
Whether they do log DNS request or not is not in the scope of the site.
After your DNS request, your computer has to access the website. In the same way, if the session is not encrypted, it can be logged.
As a matter of fact, even encrypted traffic can be logged, but it can't be read (unless you can break the crypto).
Lookup DNS over HTTPS (DoH) and DNS over TLS (DoT). You can encrypt your DNS traffic. My Asus Router supports DoT features. Newer business routers are also getting on board.
My setup is simple and works well. I use DoT to Cloudflare's family DNS servers 1.1.1.3 and 1.0.0.3 on the router. My main workstation/gaming rig runs Windows 11 and it supports DoH out of the box and I point it to 1.1.1.1 and 1.0.0.1 over DoH.
