Well you could ask your ISP if they can move you from the CG-NAT WAN IP Address to a real one, but I have no idea if all ISPs that use CG-NAT can do that for their customers, so that's for you to figure out! 
Before you do that you could also take a look at this older topic : Pi-hole works fine but unbound has a problem
And try to find similarities between that issue and your issue.
I have tested all the domains you mentioned and this is how the output should look like :
$ dig dnssec.works
; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> dnssec.works
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18971
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;dnssec.works. IN A
;; ANSWER SECTION:
dnssec.works. 3600 IN A 46.23.92.212
;; Query time: 164 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:28:36 CEST 2026
;; MSG SIZE rcvd: 57
$ dig fail01.dnssec.works
; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> fail01.dnssec.works
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 22844
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;fail01.dnssec.works. IN A
;; Query time: 112 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:29:22 CEST 2026
;; MSG SIZE rcvd: 48
$ dig www.ebanking.piraeusbank.gr
; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> www.ebanking.piraeusbank.gr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14388
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.ebanking.piraeusbank.gr. IN A
;; ANSWER SECTION:
www.ebanking.piraeusbank.gr. 300 IN CNAME d7vud2s.ng.impervadns.net.
d7vud2s.ng.impervadns.net. 30 IN A 45.60.46.218
;; Query time: 192 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:29:50 CEST 2026
;; MSG SIZE rcvd: 111
$ dig account.cosmote.gr
; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> account.cosmote.gr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48865
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;account.cosmote.gr. IN A
;; ANSWER SECTION:
account.cosmote.gr. 86400 IN CNAME wnwvkq8.ng.impervadns.net.
wnwvkq8.ng.impervadns.net. 30 IN A 45.60.74.72
;; Query time: 132 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:30:19 CEST 2026
;; MSG SIZE rcvd: 102
$ dig home-fw.ecobee.com
; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> home-fw.ecobee.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31576
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;home-fw.ecobee.com. IN A
;; ANSWER SECTION:
home-fw.ecobee.com. 60 IN CNAME hxot636.ng.impervadns.net.
hxot636.ng.impervadns.net. 30 IN A 45.223.101.23
;; Query time: 236 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:31:00 CEST 2026
;; MSG SIZE rcvd: 102
This was done from my Debian Linux laptop speaking to my Pi-Hole + Unbound setup 