Once again, this is why the script is so useful.
When you configure DoT over the WAN, it actually *does* include the router itself, NOT just the DHCP server used by the WLAN/LAN clients. Notice at the top of the header where it indicates the WAN's DNS servers, it shows 127.0.1.1, which is Stubby. However, it *also* includes the DNS servers defined on the WAN from the ISP (or the custom DNS servers you chose instead).
As a result, *any* of those DNS servers is just as likely as another to be used. What you need to do is configure "Connect to DNS server automatically" as No, but leave the custom servers blank! When you do, now you'll find that only Stubby (127.0.1.1) is available to the router.
That's why I include the header info. So you can see *why* things behave the way they do. Few ppl would even notice this is happening, let alone be able to understand why, unless they had access to the script.