Comment by nyarlathotep_

> the cellular NIC continues to maintain baked-in alternate routes on both Android and iOS

How do you know this is the case? (I believe it to be, would like to verify)

Also worth mentioning many apps hardcode DNS servers or fallback to other DNS providers when they fail to resolve hostnames. I see this all the time on my network. (I have a PfSense box that redirects to upstream NextDNS when this happens)