Found and fixed a second, uncontrolled DHCP server on the LAN (a WiFi router still in router mode instead of access-point mode) that was intermittently handing out wrong DNS/IP config to clients. log-dhcp was key to spotting it via the 'wrong server-ID' DHCPNAK pattern, so keeping it enabled going forward; log-queries (diagnostic-only, noisy) was removed again.