Yep, HTTP logs: most standalone RSS clients have a distinct user agent, and most of the web-based ones send a UA containing the total subscriber count.

For example, here's a log from today:

    8.29.198.27 - - [01/Jan/2023:00:04:42 -0500] "GET /feed.xml HTTP/1.1" 304 0 "-" "Feedly/1.0 (+http://www.feedly.com/fetcher.html; 99 subscribers; like FeedFetcher-Google)"

Interestingly, a few of the big ones (Feedly, Feedbin) have multiple subscriber counts for me. I'm not sure why that is.