Funny, I reported a bug to Mozilla about their NextDNS offering being mis-configured, and it leaked DNS queries. I turned it on by going to Preferences > General > Network Setting and then fired up Wireshark, and all the queries were sent in the clear, even with NextDNS set to 'Enabled'. They seem to have fixed it. Lesson here: sniff your network traffic and don't blindly trust that DoH is configured properly.