Part of the Furniture
That's spooky looking to me, like you're welcoming external requests to your router's DNS server.
It's out of my league though, since I don't do any port forwarding and I'm back to running John's Fork. But in case you want to solve this once and for all, you can delete your nat-start script and run these commands to setup DNSFilter for the same result to force everyone on your LAN to use your router's DNS and therefore Stubby. Then you can control it from the DNSFilter GUI.
nvram set dhcp_dns1_x="" nvram set dnsfilter_enable_x=1 nvram set dnsfilter_rulelist="" nvram set dnsfilter_mode=11 nvram commit service restart_firewall