It may be the devices not honouring your DNS directives. Sometimes they will still reach out to their own resolvers.
It helps if you have a network perimeter firewall to block unauthorized DNS usage.
It helps if you have a network perimeter firewall to block unauthorized DNS usage.