Some stuff goes onto OneDrive, which is more so I can access it on other devices easily (Windows PC, Macs, iPad, iPhone etc) than a security thing.
For actual backups I have sync jobs running on media folders to the storage pool on my server (which has duplication on the disks via Drivepool) which pairs the folders pretty much as they change, but that's more useful with a disk failure as if there was a virus it would wipe out potentially anything on running Windows. So I have a weekly backup set of USB disks which sit in a box unless they're backing up, which covers this as well, because I have a lot of media which would be a pain to get back on there off the original discs.
Everything else is backed up to another non-Windows server using
this which works a treat, but I don't include music or video files in the backup because it would take up too much space.