Since Pi-hole FTL 5.9, those queries are expected if you have DNSSEC enabled.
They are indeed issued by PI-hole itself in order to perform DNSSEC validations (see also Understanding DNSSEC validation using Pi-hole's Query Log)
You can control whether you want to see them in your logs by adding the respective SHOW_DNSSEC option to your pihole-FTL.conf.