I found a related issue here where CF was causing a loop condition from the router forwarding requests to pi-hole DNS making millions of requests and causing FTL to crash due to RAM shortage.
I removed pi-hole addresses from my UDM Pro WAN DNS configuration and disabled Unbound (for now) and the issue resolved. I can still use CF in this configuration. UDM Pro passes on the DNS requests to my upstream DNS without issue anyway (according to DNS Leak Checker) so no need to configure at the WAN side it looks like (in fact a number of sites recommend against it due to unspecified issues - I know now what those issues are!).