Since you've now verified that all your devices have acquired a DHCP lease through Pi-hole and DNS caches are flushed, your devices could by-pass Pi-hole via IPv6.
Check if nameserver IPv6 addresses returned by
scutil --dns
on your Mac would match your Pi-hole's IPv6 addresses.
You may find out about those by running the following command on your Pi-hole machine:
ip -6 address show
You may also want to Use IPv6 ULA addresses for Pi-hole.
If IPv6 addresses don't match, it's likely your router still advertises its own IPv6 address as DNS server. In that case, you have to configure your router to stop it form doing so.
You'd have to consult your router's documentation on how to achieve this.
If your router doesn't support that, you could consider to disable IPv6 entirely on your router.
If that's also not possible, your clients will always be able to by-pass Pi-hole via IPv6.