Third-Party DNS Vulnerabilities
There are many existing DNS options available, and many VPN companies use and trust third-party DNS service providers like Google DNS (8.8.8.8/8.8.8.4), CloudFlare (1.1.1.1), or OpenDNS (208.67.222.222).
This defeats all privacy efforts because these companies may be logging your DNS queries. In addition, these DNS providers do not encrypt your DNS queries by default.