I am not a fan of masquerading network traffic unless you really know what you are doing. It complicates things, and often leads to incorrect assumptions. For example, in your nslookup screenshot, it says that you are asking google's DNS for your local pi-hole. Google should not have any clue what that IP is, but because of the masquerading, it forwards to your pi-hole and it looks like google responded.
If I may, try the steps outlined here instead. Of course, you'll want to make sure that your DHCP server is issuing out your pi-hole's IP as the network's DNS server.
This may be due to IPv6 traffic from your phone. You'll need to perform the same port-forwarding/blocking steps on the IPv6 firewall. This is a speculation, however.