Found and fixed a second, uncontrolled DHCP server on the LAN (a WiFi
router still in router mode instead of access-point mode) that was
intermittently handing out wrong DNS/IP config to clients. log-dhcp
was key to spotting it via the 'wrong server-ID' DHCPNAK pattern, so
keeping it enabled going forward; log-queries (diagnostic-only, noisy)
was removed again.
mike