Okay, figured it out, had to turn off IPV6, no more DNS leak. My VPN provider says they have IPV6 DNS leak protection, obviously they are wrong, it is broken.
BTW, not every DNS leak test showed it, but this one did.
https://torguard.net/vpn-dns-leak-test.php