In essence, what I've done is set up my router to intercept all HTTPS traffic and direct it to a proxy program that I wrote myself. All the program does is look for DoH traffic and drop it on the floor, just passing the rest on to its proper destination. This requires installing a custom cert on each browser so the proxy can decrypt the HTTPS stream.

If I were to do this today, I'd look into formal tools to do this, such as mitmproxy or somesuch. That's not a specific recommendation, I've never used it. But there are a number of similar tools available. One of them is likely to be a good solution!