Exactly that. And it looks just like any other web traffic.

Quite a few things will use their own DNS servers, not the one specified by the system or handed out over DHCP. I know many apps on the fire stick and Roku devices do this. So you have to intercept their traffic and redirect it to control it. If their using DoH then you can't do that and your pihole is useless against them.

Best you can do is maintain a list of well known DoH servers and block them outright. But that's a constantly moving losing battle.