daemontus

Soo... I think it's fixed.
 
The problem was tailscale, even though tailscale is not used by any of the docker containers directly. Some more info is available here: https://github.com/tailscale/tailscale/issues/12108 and here https://www.reddit.com/r/docker/comments/1do20m6/docker_container_randomly_losing_ability_to/, but overall what happened seems to be this:
1. Tailscale is installed on the Unraid server for remote management. The docker containers don't use it for anything relevant.
2. However, tailscale changes the DNS settings of the Unraid server to allow name resolution across the VPN network. As I learned, this is largely fine, as long as the containers use the same DNS config as the host machine.
3. If a DHCP IP renewal happens, this also changes the DNS settings, at which point tailscale automatically comes in and "fixes" the config. But this may not be correctly reflected by the docker containers, especially if that container has its own IP address or it uses a custom docker network (in such case, the container does not even use the same config as the host machine anyway).
4. My understanding is that the reason why the issue was appearing randomly is because it was triggered by the DHCP renewal.
 
5. Earlier this year, tailscale added a security feature to prevent "unauthorized" DNS requests on the VPN network. Unfortunately, if the configuration in the docker container and on the host machine are out of sync, this meant that any DNS request coming from that container was recognized as malicious and ignored by the tailscale resolver, which would otherwise forward it to the "normal" DNS server before.
6. So for now, using --stateful-filtering=false with tailscale seems to have fixed the issue.

Anyway, thank you again for the help. I was looking at the wrong things, but at least you gave me a list of stuff that I checked to make sure they are probably ok and so I know I have to look elsewhere