n2gwtl I recently setup PiHole and was looking through the DNS records after setup. I noticed that connectivitycheck.grapheneos.network
shows up regularly even though I am behind the ProtonVPN.
Those connections are expected, see: https://grapheneos.org/faq#default-connections
There is a bit of a chicken-and-egg problem here. Let's say you have a VPN client turned on and it is absolutist, i.e., all traffic must go through it. Now you connect to a Wi-Fi network at a coffee shop that is using a captive portal. Until you have a chat with the captive-portal web page, the coffee shop won't let your VPN client send traffic to the selected VPN server. If your VPN client won't let you send traffic directly to the coffee shop, it would be a bit of a sticky wicket.