For the purpose of this answer, let's assume an adversary with state-level resources.
If the device's transmitters are off (airplane mode without WiFi or Bluetooth), it cannot be located in real-time by the adversary. It does not matter whether location services are enabled; using GPS (a satellite-based system with one-way transmissions from satellites) does not leak information directly. With this paranoia level, it's best to leave this off, lest any information be stored that can come out later. If you really needed GPS, rebooting before turning off airplane mode might be enough to keep you safe.
If the device has an active transmitter, it can be located. It does not matter whether you have location services enabled.
- Your mobile provider must know what towers/stations you are associated with for you to receive calls or data. For an adversary with state-level resources, you can assume that the adversary also has access to this information.
- You can assume that turning on WiFi will also reveal your location. The adversary likely has your MAC address, and Android is poor at randomizing it , with some exceptions.
If the device is compromised, you are out of luck. There is no practical way to verify that the device is not listening and recording location information for later transmission.