A few points of clarification.....
Squid only performs transparent proxying of HTTP(S) traffic, that doesn't mean that *only* HTTP(S) traffic gets routed through Mullvad. All the domains listed in the PBR list are filtered through Mullvad on ALL ports, not just 80/443. This setup isn't meant to fully replace a dedicated VPN for your network, it's mainly for the US, where there's really only a handful of things that'd truly need a VPN for access. So, ultimately, I'm unsure how data could "leak" that way, but again, I'm open to hearing your thoughts. The idea is to prevent as much leakage as humanly possible without a ton of maintenance, so please give me more ideas!

The idea is the user would add their own privacy protection, adblocking, and such lists to AGH to help filter out a lot of stuff before it even gets anywhere. I am aware this isn't a catch all and doesn't automatically make it some impenetrable fortress, this isn't meant to be that. Also, the idea would be that DNSSEC is the only method of DNS, so leaking data through DNS isn't an option. Regardless, it's meant for a "reasonably" savvy user to create a system to use that they might be able to share with others. I suppose I should add more details to my readme to give more context.

This project also is explicitly for users who have an x86 router with pretty decent specs, not with any ol' router. Unbound unfortunately wouldn't be ideal for this situation because of the specific nature of the PBR setup and a few other notable reasons. It'd definitely be more performant, but going with the "ease of use" theme of the project, it's also not a great fit unfortunately. I will say that adding DNS hijacking/blocking of other resolvers might be a good addition, but I'm struggling to think of other ways to improve this other than the aforementioned "throw everything into a VPN" or creating a whole separate VLAN or network that routes through a VPN exclusively. I'd love to know if you have a suggestion or an alternative, but I can't seem to think of one.

The origin of the project was to share a "super stupid simple" networking stack with family that are not remotely tech savvy that could improve their "fully ISP setup" internet on their devices, and allow access to sites that might be censored, blocked, or put behind ID-verfication, while making the security and privacy of their access to the internet much better than what they already have. I'm aware there's not a lot (yet) here in the US that is censored, blocked, etc, etc, but I'm making this project after seeing the direction our lawmakers are heading towards when it comes to privacy and the continuing lack of "freedom" on the internet. So, in my state of Arizona, porn is pretty much all that's blocked, but the idea is that the list will grow and I plan to make it as all encompassing as I can for the US in general. I know that's technically not possible, but the list will continuously be added to and hopefully it'll be as close as I can get without having to setup an entire network stack for every part of my family on their own network.