I used QoS in previous versions of OpenWrt - I currently don't need QoS, SQM, etc. so I'm not familiar. Security-wise, the default OpenWrt and settings are good.
The only change from default I perform is the following:
- All firewall settings that say "Reject" - I change to "Drop"
Please understand the technical implications of this change.
Nope, I don't add generally consider adding packages to make things more secure or perform better. I can't think of any, except that if you do have a Mullvad account, you can install the VPN packages necessary to configure/use on the router - setup clients to route thru it, etc. 
I believe DoH/DoT was also suggested in another post.
Hope this helps and congratulations on solving your issue.
If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.