I am not a fan of masquerading network traffic unless you really know what you are doing. It complicates things, and often leads to incorrect assumptions. For example, in your nslookup screenshot, it says that you are asking google's DNS for your local pi-hole. Google should not have any clue what that IP is, but because of the masquerading, it forwards to your pi-hole and it looks like google responded.
If I may, try the steps outlined here instead. Of course, you'll want to make sure that your DHCP server is issuing out your pi-hole's IP as the network's DNS server.
This may be due to IPv6 traffic from your phone. You'll need to perform the same port-forwarding/blocking steps on the IPv6 firewall. This is a speculation, however.
Yes:
This isn't about Pi-hole, it's about firewalling.
Go ask the guy who wrote that guide.
As he wrote it, he is in a far better position to clarify instructions, help you adopting it to your enviroment, and he's the only one who can fix potential mistakes in his guide - just as we would do for Pi-hole issues.
Give him a chance to improve his guide, or your configuration.