If router-level blocking works everywhere except one browser or phone, encrypted DNS, a device VPN or a privacy relay may be taking a different route.