Typically DNS requests or ip block access for known bot masters is a way isp / service providers can detect this.
Depending on your network (which I will assume nothing about), this traffic could be coming from another program that skips the vpn, you could have another computer, smart device on your network that was hacked, you have an open access point that someone is war driving with or a number or other likely things.