CNAME and WireGuard

Your debug log shows that none of your domain blocks (i.e. blacklist entries) are applied to group 2, which appears to be the group where you have assigned the Wireguard IP.

*** [ DIAGNOSING ]: Clients
   id    group_ids     ip                                                                                                    date_added           date_modified        comment                                           
   ----  ------------  ----------------------------------------------------------------------------------------------------  -------------------  -------------------  --------------------------------------------------
   7     2             192.168.99.2                                                                                          2020-11-11 18:35:12  2020-11-11 18:35:16