Most of the replies here are Ahrefs metrics, which is fine as a first filter but it is not vetting. Metrics tell you a site has traffic. They don't tell you whether a link from it will do anything.
What I actually check in order..
Outbound links on the page, not the domain. A site can be clean overall and still have a "resources" page with 200 casino and CBD links on it. That page passes nothing and might cost you.
Whether their existing guest posts rank for anything. Pull five recent guest posts, check if any of them have a single keyword in the top 100. If none do, the site is a link farm with a nice DR and Google already knows it.
Traffic trend over 12 months, not the current number. A site at DR 50 that has lost 70% of its traffic since March is a site Google has already downgraded. You are buying a link on a corpse.
Whether the topic actually connects. Not "same industry", actually related. A dog food review site linking to a dog training page is relevant. A generic "lifestyle" blog is not, no matter what the DR says.
That process takes ten minutes a site and rules out about two thirds of what looks good on paper. Worth saying I only bother with it for the handful of links that go to the money page. For the tiers underneath I stopped vetting targets individually years ago and pay a list provider to do it, ser verified lists and gsa link surge are what I run currently, have used ser links too. They all have ups and downs, but the point is the same, someone has to check targets before you post to them, and at volume you cannot be that someone.