Identity leaks usually happen in two places.
Off Chain Leaks
Here, the address is somehow linked to you off chain - this could be because you shared it from an account or network that can be traced to you (it's largely impossible to avoid being tagged online if a well funded and skilled group, such as nation states, is targeting you).
Alternatively, if you have sent funds to an address from an exchange or other wallet that has some link to your identity, off chain requests by law enforcement or other such authorities for your transaction data could link you to it quite trivially.
On Chain Leaks
Although modern wallets, especially Bitcoin Core, take steps to avoid this, there are scenarios where when spending funds from one address, you also include inputs sent to other addresses. If all your addresses do not have an equal level of privacy in how you shared them and received funds to them, transactions which spend from multiple addresses can create links that on chain monitoring tools use to identify clusters of addresses controlled by a single entity.
Thereafter, if any one address in the cluster is deanonymized, the entire cluster can be tagged to you retroactively.