It is being used ISP DNS even though i set up my Pi4 router with a different DNS

Seeing <> using.

Map, say google.com, to 0.0.0.0 on your router.
Try accessing it on your devices, where you think it's leaking.

If it's intercepted, the access will obviously fail.

Keep mind NordVPN will tell you you're leaking DNS queries, just to make you think you need their worthless VPN.