I don’t think this is strictly possible, because a custom title could be character-by-character identical to a badge granted one (possible of a badge the user doesn’t have).
Here’s a query that might do what you want:
SELECT username FROM users
WHERE title IS NOT NULL
AND (
SELECT count(*) FROM badges
WHERE allow_title = true
AND name = title
) = 0
AND (
SELECT count(*) FROM groups
WHERE groups.title = users.title
) = 0
It selects every title any user has, minus every title where a corresponding badge exists, minus every title that could come from a group membership. It does not test whether the user has the badge or the group membership.
Maybe it does help you, at least as a starting point ![]()