I didn't use wireshark (or any other tools).
I saw this problem after rebooting my router... one of my devices (my Mac mini) got a new IP address on wireless and ethernet... and when looking into this, I saw that dns and dhcp server where pointing to the linksys router. Also my pil.hole was seeing these IP addresses on the network... and they were marked as not going through pi.hole. I saw some of my smart devices also getting new ip addresses without going through my pi.hole dhcp server.
I renewed the IP addresses on both interfaces and it got it's old IP address back from my pi.hole dhcp server.
Besides my pi.hole,I have no other devices capable of giving out IP addresses on my network.
After seeing this, I enabled the DHCP, rebooted the router, disabled it, rebooted again... and it has been working fine since then even after multiple reboots.
I never had the DHCP server on the linksys router enabled on my network... I just had it enabled when doing the initial configuration with my laptop... I disabled it before connecting the router to my network... so I don't really know where this bug is coming from. It might have something to do with when I upgraded to latest firmware... I should have done a factory reset after this upgrade.