I hit this situation a few times yesterday and saw SERVFAIL errors from several domains and clients, but what you’re saying seems possible, that there’s a client trying to spam an unresolved domain.
pi@raspberrypi:~ $ echo ">stats >quit" | nc localhost 4711
domains_being_blocked 220652
dns_queries_today 126847
ads_blocked_today 4458
ads_percentage_today 3.514470
unique_domains 3078
queries_forwarded 115135
queries_cached 2744
clients_ever_seen 19
unique_clients 19
dns_queries_all_types 126847
reply_UNKNOWN 18465
reply_NODATA 22165
reply_NXDOMAIN 2301
reply_CNAME 42947
reply_IP 34581
reply_DOMAIN 242
reply_RRNAME 82
reply_SERVFAIL 4679
reply_REFUSED 391
reply_NOTIMP 0
reply_OTHER 0
reply_DNSSEC 0
reply_NONE 0
reply_BLOB 994
dns_queries_all_replies 126847
privacy_level 0
status enabled
pi@raspberrypi:~ $ echo ">top-domains >quit" | nc localhost 4711
0 5220 gateway.fe.apple-dns.net
1 4339 a79f7b502bae9945a.awsglobalaccelerator.com
2 3861 api.ring.com
3 1622 gateway.icloud.com
4 1551 e673.dsce9.akamaiedge.net
5 1102 canary.mask.apple-dns.net
6 1032 www.apple.com.edgekey.net
7 1012 e6858.dscx.akamaiedge.net
8 1010 us-sw-courier-4.push-apple.com.akadns.net
9 949 api.apple-cloudkit.fe.apple-dns.net
pi@raspberrypi:~ $ echo ">top-ads >quit" | nc localhost 4711
0 849 metrics.icloud.com
1 308 app-measurement.com
2 191 us.dev.zeronaught.com
3 180 googleads.g.doubleclick.net
4 177 fls-na.amazon.com
5 136 notify.bugsnag.com
6 103 sessions.bugsnag.com
7 77 alb.reddit.com
8 70 cdnssl.clicktale.net
9 69 cdn.dynamicyield.com
pi@raspberrypi:~ $ echo ">top-clients >quit" | nc localhost 4711
0 121566 192.168.4.1
1 1303 fd38:ae48:87af:1:107e:f984:9ac5:8719
2 756 fd38:ae48:87af:1:181b:4951:3a22:91f8
3 717 fd38:ae48:87af:1:842:7502:fc9f:3d7c
4 556 fd38:ae48:87af:1:403:1cce:f2:13c0
5 464 127.0.0.1 localhost
6 324 fd38:ae48:87af:1:46a:3a8:9cef:5ccc
7 317 fd38:ae48:87af:1:8ee:275f:772:4d33
8 233 fd38:ae48:87af:1:1c4b:a8e3:d966:12f7
9 182 fd38:ae48:87af:1:8210:6995:3b91:f4bd pi.hole