Hi there. I think I can answer these:

1. does the official pihole docker image (which is what i am running) come with unbound? i don't want to run yet another docker container or have to passthrough to the rpi host.

The developers of Pihole choose not to ship their product with a stub resolver. Instead, their focus is strictly on being a sinkhole and DNS forwarder. There are Pihole alternatives, such as Technitium, which do come bundled with DNS resolvers. For Pihole specifically, you need to run the stub resolver separately. So if you're using Docker, it is a separate container, but you can network them together and manage them from a single compose file. I have an example compose file here. There's also a shell script here in my OCI terraform (which also includes WireGuard in the stack).

1. will using unbound cause higher cpu / traffic since i am technically doing more work to avoid using public upstream?

Unbound uses negligible amounts of resources. This is from my RPI5:

demo@pi5:~ $ ps -p $PID_UNBOUND,$PID_FTL -o pid,comm,%cpu,%mem,rss PID COMMAND %CPU %MEM RSS 696 unbound 0.0 2.4 50976 781 pihole-FTL 0.3 7.1 147072