OK. There are limits to how much I can help you with this. DTS supports VPN products built using the Network Extension architecture. Once NE shipped, we stopped supporting older techniques [1] [2].
Coming back to your original question:
How should these DNS queries be handled?
It’s hard to give a good answer given that your product isn’t built on a solid foundation. However, my inclination is to simply drop these on the floor and see what breaks (-:
Based on the comments here, I suspect these are coming out of the NetBIOS client.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] This includes iOS’s semi-private VPN plug-in architecture and the ad hoc VPN techniques that were prevalent on earlier versions of macOS.
[2] Speaking of older techniques, I want to put in a plug for TN3165 Packet Filter is not API.