Your router with IP 192.168.2.254 is advertising its own IP for DNS to the clients alongside the Pi-hole IP 192.168.2.3.
This means that clients can bypass Pi-hole:
If you cant get the routers DHCP service to only advertise the single Pi-hole IP for DNS, you could opt to let Pi-hole take over DHCP services for your LAN:
EDIT:
Oh Youtube ads cant be blocked as the ads are coming from the same domains as where the content is coming from.
A browser ad blocking plugin can fill that gap or get a Youtube premium subscription.