grep registry-1.docker.io /var/log/pihole.log
Jan 25 00:06:56 dnsmasq[5772]: query[A] registry-1.docker.io from 192.168.18.9
Jan 25 00:06:56 dnsmasq[5772]: /etc/hosts registry-1.docker.io is 52.4.20.24
Frak! Of course, first obvious thing I did not check. I removed the ip from the hosts file and this looks solved now.
Just wondering now how it got there.