Those DNS requests are coming in via the VPN router.
Pi-hole is not responding to these reuests. At least that is what the message (kind-of) tells me: ignoring query from non-local network 10.120.120.14 (logged only once).
Does your router terminate the connection to your clients and forward DNS requests to Pi-hole from its own IP, or simply source nat the packets, replacing source IPs with its own, or does it simply forward packets to your Pi-hole host's IP? Or is your Pi-hole host a first class VPN citizen as well?
That may suggest that your Pi-hole host does not have a VPN range IP.
In that case, you'd have to switch Pi-hole's Interface settings to Permit all origins via Settings | DNS.
Obviously, they are not, or else the requests would register in Pi-hole under your router's IP.
If you can guarantee that VPN DNS requests would always arrive on a specific network interface of your Pi-hole host machine, you could also switch to Bind only to interface xxxn.
As that may not work if Pi-hole is hosted via some kind of virtualisation environment, it's usually easier to use Permit all origins.
Note that Pi-hole's Interface settings handle the network interfaces that Pi-hole should monitor to receive requests from.
Traffic filtering by source IP would be a firewall's job, hence the warning in Pi-hole's UI:
These options are dangerous on devices directly connected to the Internet such as cloud instances and are only safe if your Pi-hole is properly firewalled.