ECS removed when on vpn wire guard

Hi not sure where my issue is yet 

No issues :

iPhone using profile

UniFi using nextdns cli

wifi or cellular dnscheck.tools reports ECS  subnet 

When I use wire guard vpn into the UniFi ECS is lost  when checked at dnscheck.tools

not sure if this worked before as I decided to check while on vpn, seems vpn I’m loosing the apple  profile 

While on vpn test to nextdns shows profile was sent but no ECS 

status": "ok",
"protocol": "DOH",
"profile": "fxxxxxxxx",

"server": "vultr-ewr-1",
"clientName": "nextdns-cli",
"deviceID": "DA420",
"deviceIP": "192.168.3.2"

I did notice it don’t use my apple profile and random device id appears , I’m not sure why nextdns cli is picking up anything as my phone is DOH

Any tips ?