Flood of queries to example.com / ipv4only.arpa / detectportal.firefox.com from the linux client burning through the 300k limit

Dear all,

I have been using NextDNS since its beginning, after checking today my current usage, I have seen something that I have never seen before.

I am on a linux desktop, using nextdns on my browser configuration, but also use the linux client for general use of nextdns as dns resolver for system.
I have attached a screenshot of the web interface of the analytics :
we can see a big jump of requests for ipv4only.arpa / example.org and detectportal.firefox.com

I have never seen those requests to this proportion, cf the graph of total request on the top. In 10 days I have more than 200k request for those domains.
After digging in the journalclt, I have seen that it is the nextdns client that is querying a lot those domains.
Is it normal ? I have never monitored this behavior, and it burns through 300k limits in no time.