This is the reason why I mention Firewalla:
Firewalla once started, will start to tell each of the connected devices that it is the router and tell everyone"please send all network traffic over". This essentially will virtually divert all live traffic to Firewalla to be monitored and managed.
Professionally, this method is called arp spoofing. A 'creative way' to do a man in the middle. In our case, the 'good' man is Firewalla. And we modified a few things to make this work better at home. (This method was an inspiration from another product on the market, we take no credit inventing this)
But why does the Pi Hole tcpdump capture Chromecast multicast packets? I see what you mean that it's taking the shortest path so hence no 8.8.8.8 in the capture. Just wondering why the multicast traffic does get captured.