Isolating which process is performing DNS queries

[notrox]

I recently upgraded my OPNsense firewall to the latest version and now I'm seeing millions of DNS requests for cisco.com in Adguard which is running directly on OPNsense. I ran a packet capture and I'm only seeing the DNS queries on my Wan interface and nothing on my internal interfaces. Any help would be greatly appreciated.