Any time you execute code acquired from someone that you haven't fully reviewed and it runs on an Internet connected system, there is a risk that the person who wrote or deployed that code could transmit data about your usage to another system. That's true regardless of the OS. So yes it's possible.
The question then becomes "has this happened in the past", and "is it likely to happen in the future". The only case that springs to mind where people may have been sending data form a linux distro to 3rd parties inadvertently was the ubuntu linux Shopping Lens which could be regarded as spyware and was by some.
Outside of that, I'm not aware of any instances of large-scale spying from the mentioned linux distros. As you say pentest distros like kali are obviously an inviting target, but then their users are more likely to notice an indiscriminate transmission of data from their systems.
Ultimately it comes down to trust. By executing code belonging to someone else you are trusting them (think of trust in this context as "the power to betray") with any data you enter into that system.
How you establish trust in a system is a really good question and one which, as far as I can see, is far from answered.