Ahrefs says "and other third party data sources to find keywords" [0]

Pretty sure they buy data from software tools like free anti-virus scanners, toolbars, chrome extensions, VPNs, etc that resell their user's web browsing history. This is called "click stream data".

[0] https://help.ahrefs.com/en/articles/78119-where-do-you-get-t...