You are correct in understanding that as it is currently interpreted, Commerce Clause authority is incredibly broad.
Generally speaking, an activity can be regulated under the Commerce Clause if it involves a transaction or transportation across state lines. But it can also be regulated if the activity -- combined with other people doing the same thing -- has a nontrivial impact on interstate commerce. That was the case in Gonzalez; a single person growing a single marijuana plant would have little effect on the interstate market for marijuana, but because many other people do the same thing, the effect becomes nontrivial.
Because the test is so broad, there was a long period where you could safely guess the outcome of any Commerce Clause challenge by assuming that any activity was within the scope of Congress's authority to regulate.
There has been some narrowing over the last 25 years or so, though, beginning with United States v. Lopez, where the Court said a law made it a felony to carry a gun in a school zone: "The possession of a gun in a local school zone is in no sense an economic activity that might, through repetition elsewhere, substantially affect any sort of interstate commerce." United States v. Lopez, 514 U.S. 549, 567 (1995).
A few years later, the Court also struck down a portion of the Violence Against Women Act that allowed victims of gender-based violence to sue their attackers in federal court -- partly because of the attenuated link between violent crimes and interstate commerce, and partly because of a separate concern about how to allocate authority to regulate criminal conduct in general, which has traditionally been the province of the states: "The Constitution requires a distinction between what is truly national and what is truly local, and there is no better example of the police power, which the Founders undeniably left reposed in the States and denied the central Government, than the suppression of violent crime and vindication of its victims. Congress therefore may not regulate noneconomic, violent criminal conduct based solely on the conduct's aggregate effect on interstate commerce." United States v. Morrison, 529 U.S. 598, 599 (2000).
Probably the most notable of the recent cases was the Obamacare decision, where the Court held that Congress could not regulate people based on their decision not to purchase health insurance -- that is, the Commerce Clause allows Congress to regulate economic activity; it does not allow it to regulate inactivity: "The individual mandate forces individuals into commerce precisely because they elected to refrain from commercial activity. Such a law cannot be sustained under a clause authorizing Congress to 'regulate Commerce.'" Nat'l Fed'n of Indep. Bus. v. Sebelius, 567 U.S. 519, 558 (2012).
As you can probably see, these are pretty narrow areas that Congress is unable to regulate. Broadly speaking, you should assume that if you are buying or selling anything, or if you are in any way using the "instrumentalities" of interstate commerce -- such as roads, phone lines, the Internet -- Congress has authority to regulate your conduct.