If they don't use DoT/DoH, you can try redirecting traffic for 8.8.8.8:53 to your own DNS server with one or two firewall rules. If they're actually securing the connection that won't work, though.
Indeed. I block port 853 and various popular DoH servers and then rewrite any port 53 access to use my servers. So far it's working well. Frustrating that so many devices ignore DHCP (IPv4) and RADVD (IPv6) recommended name servers.
