found a registry key containing the IP address
that contains, among a lot of other XML info, a string:
ID="DNSResiliency-CloudFlare-Live"
This fallback must of been activated by something, no idea why, I haven't noticed any pihole DNS delays or problems...