It’s a lost cause. The router should be treated as hostile and shouldn’t be allowed to know anything if possible. DNS over HTTPS and that SNI encryption stuff should be used.
I have found that rather than finding a way to sneak ads in, most non browser apps will just detect that the ads are missing and throw up an error refusing to display the content.