Note the size of your ENDS udp packet vs mine. It could be the Sophos as well but I'd assume there would be logs showing the udp packet oversize drop.
Edit:
Yours
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
Mine
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096