ah I just installed dnsutils on the container so I could try out dig for troubleshooting.
This is what I got:
root@a520d6f73159:/# dig internal.domain.com @192.168.9.2
;; reply from unexpected source: 172.17.0.1#53, expected 192.168.9.2#53
;; reply from unexpected source: 127.0.0.11#53, expected 192.168.9.2#53
If I set the wireguard container to use pi-holes container IP (172.17.0.1) I get a correct DNS response.
I will look in to this tonight.