This might be due to Firefox often defaulting to sending DNS to cloudflare unless otherwise configured.