What's frustrating is that DNS is returning an address, instead of just failing, and so macos is caching that value (though it might be cloudflare doing that).
Wildcard DNS should be a prosecutable crime, punishable by no less than 20 years of hard labor.
(Edit: Probably should have made it clear that this was a joke)
Presumably you're referring to the practice of answering queries for nonexistent records with an A record belonging to an advertisement page? (instead of doing the right thing answering NXDOMAIN, presuming no records of another type also exist for the queried name.)
dnsmasq has a really useful feature for dealing with this: --bogus-nxdomain
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder