You've confirmed the ipconfig output show that the Pi-holes at .2 and .3 are the only configured DNS servers. All this implies that something running on your Windows client is intercepting DNS requests and sending them directly to the Leaseweb DNS servers. The requests never get to your Pi-hole or Unbound.
Another possibility might have been that your router was doing a similar kind of redirection, or even that your ISP was interfering with the traffic, but in that case the requests would have first gone to Pi-hole and been sent upstream to your Unbound, and then interfered with after that, so you would still be seeing your tests in your Pi-hole logs.
I welcome any thoughts from the devs/mods in case I've overlooked something in all this.
Are you running any VPN software, anything like that? Any DNS or "helper" tools, any privacy tools, anything like that? Sometimes these kind of apps take it upon themselves to reconfigure how things work. Do you have antivirus and can you scan your computer? Don't be alarmed by asking that, it's worth checking though because redirecting DNS to a hosted instance is also something that malware might do.
Your nslookups...
This chaos class txt query for version.FTL is something only Pi-hole understands. Your result shows that nslookup is asking one of your Pi-holes (in this case the one at .2) which is correct since that is one of the configured DNS servers. But this request gets redirected and the server that answers is not Pi-hole and so cannot make sense of this query and returns a refused response. If the Pi-hole had answered it would have returned its FTL version.
Pi-hole:
$ nslookup -class=chaos -type=txt version.FTL 192.168.1.2
Server: 192.168.1.2
Address: 192.168.1.2#53
version.FTL text = "v5.23"
Random external server:
$ nslookup -class=chaos -type=txt version.FTL 9.9.9.9
Server: 9.9.9.9
Address: 9.9.9.9#53
** server can't find version.FTL: REFUSED
The other two nslookup should give the strings ATLAS and c-root but instead they returned an Unbound version, implying that again a different unexpected server replied. Unbound is commonly used by providers.
As deHakkelaar suggest try running one of these version nslookup without specifying a server. That would normally cause your Pi-hole to reply with its version, which should look something like this:
$ nslookup -class=chaos -type=txt version.bind
Server: 192.168.1.2
Address: 192.168.1.2#53
version.bind text = "dnsmasq-pi-hole-v2.89-9461807" <-- this has come from Pi-hole
but if the query is being directed away from Pi-hole to another server, you'll just get that previous response instead, ie
text = "unbound 1.13.2"
