It's not a 100% guarantee, they can easily bypass your DNS by either just connecting to another DNS sever over plain, unencrypted DNS (UDP on 53), or use something more sophisticated like DNS-over-TLS or DNS-over-HTTPS.

You can reroute unencrypted DNS requests to your Pi-Hole using a firewall like OPNSense, but things get more complicated with DoT and DoH