[p00f]

You can't use a PiHole, for example

[jsjohnst]

Depends on your firewall, but yes you can (assuming your goal is to block those queries)

[eddyg]

Which firewalls let you block DNS over HTTPS? (Without resorting to blocking random IP addresses from some list that constantly needs updating.)

[jsjohnst]

pfSense - it only blocks known DNS over HTTPS servers, but generally all “smart” devices that use it use the publicly available servers. I log and periodically check TCP flow metadata, so I could identify new ones later.