What is it that makes it infeasible to accomplish DIY DNS-based blocking on an OpenWRT router, without the need for an RPi. It makes me wonder if the modified dnsmasq Pi-Hole uses requires more resources that the un-modified version one normally finds on OpenWRT routers.
With respect to what this person is trying to accomplish, third party VPN is OK, but is it really necessary if one has a publicly reachable IP at home. OpenWRT routers often come with Wireguard pre-configured, and if not it can usually be installed no problem.
(Of course you could run OpenWRT on the RPi but is this a popular choice, given the specs of the earlier models.)
For experimenting with DoH at home, I am using dnsdist from PowerDNS.
1. For examlpe, users who prefer to run their own OpenWRT router at home, either in place of or in addition to one provided by an ISP.