Correct.
The 3 172.x networks each have a vdsl router as gateway, and each is doing NAT, but that’s upstream from this router, and are happily routing the internal traffic from the LAN interfaces (eth0 and eth1).
I have suspected it has something to do with the LB rules not playing nice with locally originating traffic, such as pnds so it seems you are right, it is not pdns that has the issue. The SERVFAIL (above) with after doing a successfuly lookup using the 2nd internal vyos router threw me.
I think i just need to sort out the iptable mangle rules then it should be able to route the local originating traffic?