Did you know that Mastodon Admins have the power to hide your posts to any user that's not logged in?
They would have to enable "Hide public timeline from logged out users".
Furthermore, enabling "Authorized Fetch" makes it so that users that are logged into an instance that is blocked, cannot see or interact with your posts.
If these things are important to you, you should discuss them with your admin or consider migrating to an instance that has these features enabled.
Otherwise, every post you have set to "public" can be read by *anyone* via the website.
Also, Mastodon has a built in RSS feed for every profile that cannot be disabled without editing the code. This would allow *anyone* to follow you, even without an account, and you would have no idea about it.