the VPN had an IP address so it didn't need that, and then the devices were going through the VPN to get DNS. this is normal with stuff like wireguard, usually you set one or two DNS IP addresses to use with it and they get elevated to higher priority (lower metric) than the rest of the connections and it goes through the VPN for it. pretty funny that the ISP was blocking their access just by blocking DNS tho. but that above is the reason why the VPNed devices were getting through, everything until a non-firewalled outbound was going via IPs.

Yeah caught that unknown host part right before I smacked the sign button, agreed.