In my case, the trigger for the primary resolver entry going back to the
local (non VPN provided) state is any wifi reconnect, which is often
invisible to the user. The laptop hops from one AP to another,
mDNSResponder pushes the local DNS server to ...
