This seems to be very similar to DNS leak with Tailscale and the Mullvad exit node. - #2 by Bucking_Horn.