The magic seems to be on what comes next - the log you posted looks to me like w normal DNS query via your cgnat (the 100.x.x.x ip) and that got answered by centralnic as the SOA. If that's because your DND is configured that way or the request for cascaded until the SOA had to answer I see no way of telling for sure.
For the reason why: as it's right at the startup I'd guess update check or telemetry - those are my go-to suspects:)