One of the last OpnSense upgrades must’ve broken the router advertisements, which lead to clients receiving the routers IPv6 address as a DNS server, which lead to e.g. Android phones blocking all web page loads for 1-2 seconds until it fell back to my DHCPv4 supplied DNS server. Phew.