1. don't put devices with untrusted operating systems on your home network in the first place

2. if you must, put them in a quarantine vlan

a better question is why you have things in your home network that might be sending encrypted dns queries outside of your control, what software or OS is doing that?