Call tracking swaps trackable numbers for your real one, per source: one number on the website for organic, dynamic numbers for ad clicks, so every call carries its origin. Google's own call assets handle ad calls free; third-party trackers (CallRail-class, ~$45+/month) cover the rest and record calls.
The listing-safety rule that answers the second fear: your Google Business Profile keeps your REAL number as primary (tracking number as secondary if desired), and your site's schema/footer keep the real number too. Done that way, NAP consistency survives; sloppy number-swapping everywhere is what scrambles local SEO.
Minimum viable version, zero tools: train one question into every intake. 'how did you hear about us?'. Logged in the CRM. Fuzzy but free, and it sees channels no tracker can.