SERVFAIL is pretty generic.
You have to determine if its Pi-hole or Unbound generating this return code.
You can do that by inspecting the Pi-hole and Unbound logs.
Some hints to go about below:
Also make sure date/time on the host is correct for DNSSEC validation to succeed: