Although it's really difficult to correlate subdomain.domain.com, 220.127.116.11, and 18.104.22.168, two issues jump out at me. Here's my take on what I think you're telling us.
ProxyPass directives must always have a trailing slash:
Does this really mean that it has been bypassing my specified proxy for every DNS lookup, instead making those directly with my main connection, just because I did not actively check (or even notice) that box?
And who would ever want to use a proxy but not have DNS queries go through it?
People who use a proxy for reasons other than privacy, e.g. ...
This option was introduced in Pale Moon version 27.6.0 in 2017
Its purpose is to prevent
A DNS leak refers to a security flaw that allows DNS requests to be revealed to ISP DNS servers, despite the use of a VPN service to attempt to conceal them. Although primarily of concern to VPN users, it is also possible to prevent it for proxy ...
I haven't tested this but a product like https://ngrok.com in theory allows you to access a SSH port over https by forwarding TCP traffic.
If that works then you can set-up a SOCKS proxy or something using good old SSH or any other tunnel.
Ngrok encapsulates your TCP traffic within HTTPS so whatever firewall or filter is none the wiser.
I was able to achieve exactly this via the following:
Set up nginx locally.
Create server configurations for each subdomain; for example:
listen 443 ssl;
This script may do it:
REM Enable-Disable System Proxy in one file
SET home_key="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
FOR /F "tokens=3" %%L IN ('reg query %home_key% /v ProxyEnable' ) DO SET currentProxy=%%L
IF %currentProxy% == 0x1 goto turnoff
IF %currentProxy% == 0x0 goto turnon
reg add %...