I am not familiar with your switch so I don't know how it handles tagged and untagged networks on the same port. Can you please try taking ports 1 and 4 off of VLAN 1 (remove them from untagged or put them as tagged on vlan1)?
I still suspect it is something to do with your VLAN configuration and using VLAN1/LAN interface subnet. I have a similar configuration with Unifi APs and switches but I don't use VLAN1. My wired and wireless clients all connect to VLAN10, 20, 30 etc., and nothing connects to the LAN interface's subnet except for brand new trunk devices that need to be configured. My LAN interface subnet does not have a corresponding wireless network and I have a management VLAN that I use for administration of the Unifi devices.
Have you tried looking at Firewall->Log Files->Live View and watching for traffic from a guest network device trying to access the Internet? You can set the source filter to the IP of the network device. If you don't see traffic there, it's not a firewall/rules problem.
How did you confirm your DNS service is "reachable" on VLAN 20? Did you set a PVID on your switch for port 1 and 4 (I'm not sure how your switch handles native traffic)?