AdGuardHome works only via VPN? (Synology Docker & UniFi UDM SE)

[kognito]

Hi team,
I've come across a very peculiar issue where it seems AdGuardHome only fully blocks in-page ads and tracking URLs when connected via VPN to my UniFi UDM SE. (either L2TP or Wireguard)

So if I'm just in my local LAN connected via WiFi AdGuardHome does block some activity, but in-page ads are still showing and AdBlock Tests are showing everything is still coming through:

However, when I'm connected via VPN (on both my Mac and iPhone) to my network, AdGuardHome blocks all in-page ads and I can see each ad's URL blocked in the Query Log. The AdBlock Tests are showing things are being blocked and I can also see on https://1.1.1.1/help that I'm connected via DoH:

Both the local network as well as the VPN Servers' networks use the LAN IP of my Synology NAS that's running AGH in Docker. dig and nslookup show the same, whether I'm connected to the LAN or via VPN.

I've also set up some firewall rules that should block all port 53 traffic not destined for AGH, but that doesn't seem to be working either.

I'd really appreciate any advice or suggestions!

Thanks so much for your help!