There should not be a secondary DNS server (other than Pi-hole) configured/pushed by router or else ads etc will still leak through: