Theoretically Google matches a footprint from various points.
For example, if you host your 10 site PBN in the same host with the same IP you leave a huge footprint. But if those sites are legit, not part of a PBN, Google doesn't mind a lot.
The problem start when you start linking others site (or your money sites) from those sites in the same IP. If all 10 point to the same moneysite: BINGO
But let's say you have all 10 site in 10 different IP
All 10 site, use the same privacy WHOIS and all 10 are in Namecheap. And your site is being linked by exactly 12 domains = All 12 with different IP, but 10 with same registrar + whois privacy and 2 with a different registrar
Isn't it suspicious that 80%+ of the incoming domain have the same WHOIS information (despite of being private?): first flag for a footprint.
Then it may check for the technology: all 10 are in wordpress? There are a lot of websites online with wordpress (~40% of the internet), but Google clearly sees 10 sites with wordpress + 10 sites in the same registrar + same WHOIS privacy
At some point, that noone really knows, Google with pull trigger and say: "I have enough evidence to think that this is a PBN".
So depending on your level of paranoia, you may choose to vary loads of elements within your PBN.
Personally I think that if the WHOIS is private, Google will not use it as part of the footprint because it is too arbitrary.
But if you leave the WHOIS publicly available you are going to be captured similarly to the IP example I commented before.