They are completely normal if you enable DNSSEC within Pi-hole, related to Pi-hole's DNSSEC validation, see also