Do you have any evidence to support this statement? Or did you mean people's post-mixing behavior is enough to deanonymize them, as opposed to any flaws in ChipMixer's processes? As far as I am aware, ChipMixer is one of the only mixers in which it hasn't been possible to link deposits and withdrawals.

Depends. If you don't use Tor then you won't leave any additional blockchain evidence, since your IP is not recorded on the blockchain, but you will reveal your IP to any servers you connect to (in the case of SPV or custodial wallets), any nodes you connect to, any explorers you use, and the mixing site themselves, all of which could be used to deanonymize you.