Plain Debian (jessie to sid) uses openresolv: Debian -- Details of package resolvconf in sid
Does Raspbian/DietPi really use something else? If so, do you know where the source code is?
Maybe this one?
https://salsa.debian.org/debian/resolvconf/-/blob/master/bin/resolvconf
Time to restart auditing to check what it was.
Well, yes. Some (whatever) component received an RA with the IP of your second Pi advertising it as nameserver. It may have been dhcpcd which ran resolveconf itself (so this has nothing to do with you stopping the service at all).
Yes. My speculation: Second Pi-hole got a new address and this is getting advertised on the network. dhcpcd on the first Pi-hole receives this, and decides it has to update resolv.conf to pick up the "new" DNS server. For this, it does not modify the file itself but calls resolvconf. Which also does the unbound kicking.
Question: Did you configure something for this to happen?
Sorry for maybe asking the same question twice: do you use Pi-hole's DHCP server on the second one?
Do they both have resolvconf installed? If so, do the config files differ?