DNS over TLS is set up on WAN tab with Cloudflare DNS servers as TLS targets. ISP DNS addresses are the default DNS addresses on the same page but I assume go unused because of DoT setting. I'm unclear if the guest networks use the default DNS address or they, too, use the DoT configured addresses.