> There are also some devices that have hardcoded DNS settings that bypass any local network DNS settings.

You can intercept those as long as they're not using DoH/DoT.