Finally got around to upgrading my Mikrotik router to a first class citizen. Ripped out the other devices and have the network running solely off it.

Also switched from blocking DNS queries at the border to masquerading the traffic to the adguard raspberry pi to eliminate DNS retries.