Your debug log shows your router's DHCP server to distribute ist own IPv4 address as local DNS server:
*** [ DIAGNOSING ]: Discovering active DHCP servers (takes 6 seconds)
Scanning all your interfaces for DHCP servers and IPv6 routers
* Received 305 bytes from 192.168.1.1 @ eth0
Offered IP address: 192.168.1.10
(…)
DHCP options:
Message type: DHCPOFFER (2)
(…)
lease-time: 86400 ( 1d )
dns-server: 192.168.1.1
router: 192.168.1.1
--- end of options ---
Accordingly, your nslookup results show that the client has not been using Pi-hole for DNS, but your router at 192.168.1.1.
While it would be preferred if your router would distribute your Pi-hole host machine's IPv4, this could still be a valid configuration - as long as your router would forward DNS to your Pi-hole exclusively (but note that you won't be able to attribute DNS requests to individual clients in such a configuration).
As resolution for flurry.com returns 0.0.0.0, that would indicate that your router has forwarded the request to a DNS server that blocks flurry.com.
To confirm that flurry.com was indeed blocked by Pi-hole:
How does that request register in Pi-hole?
This is the first time that you mention VLANs.
Since you are able to connect to your Pi-hole host machine on port 53 from each of your VLANs, that would indicate that your router allows inter-VLAN communication, at least to 192.168.1.10.
However, if your router would also distribute its respective own IPv4 as local DNS in each of its VLANs, this wouldn't be relevant:
Clients would talk to your router for DNS, with your router aggregating all your VLANs traffic under its own 192.168.1.1.
Unrelated to your observation, your debug log shows you are trying to block quite a few entries using a URL (starting with https://) rather than a domain, e.g.
*** [ DIAGNOSING ]: Domainlist (0/1 = exact white-/blacklist, 2/3 = regex white-/blacklist)
id type enabled group_ids domain
--- ---- ------- ---------- --------------------------------------------------------------------
(…)
27 3 1 0 ^https?://([A-Za-z0-9.-]*\.)?doubleclick(\.\w{2}\.\w{2}|\.\w{2,4})/
You should either convert those entries to match domains or remove them.