Some devices use hard coded DNS (looking at you G). You can force devices to use the pi-hole via masqurading. In you example, you'd be able to see the malware requests show up in the pi-hole interface.