we've experienced something similar here. Just wondering if there's a tech note or article describing the cause and fixes?

So, firstly Yes. It does look like in some cases they are using "Happy Eyeballs", because in some cases, I see the first UDP Flow as IPv6 targeting a "well known" DNS server. I attempt the open, and the peer closes it. Immediately after, I see another new UDP flow, this time over IPv4 targeting the same "well known" DNS server ;but again the flow is immediately closed by the peer. I thought the NEDNSProxy would appear transparent to the peer, (i.e. it is oblivious to the fact there's a network extension in the mix). Now, I'm not so sure. Either way ,it does feel like a lot of DNS traffic that my proxy is not getting to take part in. (I've seen these connections come from Brave browser, Slack and Also safari (though this could be an extension).