I believe you're the first one to confirm here on Discourse that CGNAT is causing problems for Unbound.
Thanks for the feedback!
EDIT: Oh dont forget below one!
And set verbosity to zero again.
EDIT2: Next time we can go for the throat directly asking for the WAN IP of the router (or a traceroute):
Note that Tailscale utilises a special (sort of private) IP range (100.64.0.0/10) that is reserved for CGNAT