Found another culprit, causing 'status 14' to be high.
This time (today), the majority of the errors are caused by an nvidia shield pro (android tv) device.
partial result, illustrating the problem, the actual grep result is much longer.
cat /var/log/pihole/pihole.log | grep cdn-0.nflximg.com
Apr 9 12:55:54 dnsmasq[18854]: 23434 192.168.2.240/53924 query[A] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:55:54 dnsmasq[18854]: 23434 192.168.2.240/53924 forwarded cdn-0.nflximg.com to fdaa:bbcc:ddee:2::5552
Apr 9 12:55:54 dnsmasq[18854]: 23435 192.168.2.240/57834 query[A] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:55:54 dnsmasq[18854]: 23434 192.168.2.240/53924 reply cdn-0.nflximg.com is <CNAME>
Apr 9 12:55:54 dnsmasq[18854]: 23436 192.168.2.240/53924 query[AAAA] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:55:54 dnsmasq[18854]: 23436 192.168.2.240/53924 forwarded cdn-0.nflximg.com to fdaa:bbcc:ddee:2::5552
Apr 9 12:55:54 dnsmasq[18854]: 23437 192.168.2.240/57834 query[AAAA] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:55:54 dnsmasq[18854]: 23436 192.168.2.240/53924 reply cdn-0.nflximg.com is <CNAME>
Apr 9 12:56:25 dnsmasq[18854]: 23481 192.168.2.240/53924 query[A] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:56:25 dnsmasq[18854]: 23481 192.168.2.240/53924 forwarded cdn-0.nflximg.com to fdaa:bbcc:ddee:2::5552
Apr 9 12:56:25 dnsmasq[18854]: 23482 192.168.2.240/57834 query[A] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:56:25 dnsmasq[18854]: 23481 192.168.2.240/53924 reply cdn-0.nflximg.com is <CNAME>
Apr 9 12:56:25 dnsmasq[18854]: 23483 192.168.2.240/53924 query[AAAA] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:56:25 dnsmasq[18854]: 23483 192.168.2.240/53924 forwarded cdn-0.nflximg.com to fdaa:bbcc:ddee:2::5552
Apr 9 12:56:25 dnsmasq[18854]: 23484 192.168.2.240/57834 query[AAAA] cdn-0.nflximg.com from 192.168.2.240
Apr 9 12:56:25 dnsmasq[18854]: 23483 192.168.2.240/53924 reply cdn-0.nflximg.com is <CNAME>
database entries (for Apr 9 12:55:54 entries):
Although the device is IPv6 capable, I didn't enable IPv6 on this device, however, just like a chromecast, the nvidea shield (or the app?) appears to ignore the fact it shouldn't make AAAA queries, if IPv6 isn't enabled. Added (just now) the device to the 'allowAqueriesOnly' group, this will trigger the regex blaclist '.*;querytype=!A' (will everything still work? will find out in a few days, works perfectly for a chromecast). This should eliminate some of the 'status 14' entries (caused by AAAA queries). Nothing I can really do about the repeated A queries (device is fully patched)...