Anonymise Webform submission in database
I would intercept on the redirect/thank you page after form submission assuming the mail is send directly (is it).

See modules/webform/src/EventSubscriber/WebformSubscriber.php where $webform_submission = WebformSubmission::load($route_parameters['webform_submission']);
.

You probably need to override the service webform.event_subscriber defined in webform.services.yml