Ironically, CNAME blocking is actually a (potential) privacy leak depending on your network configuration. It does a DNS look up (ignoring your system DNS settings) and checks what the CNAME record is pointing to against the block list. Assuming you have control of your DNS settings, you've (hopefully) configured your DNS to use Quad9 or something similar rather than Cloudflare (questionable) or Google (outright invasive). UBO ignores this choice. UBO also recently added a warning about this in their extended info on the option, and it's been featured on HN a few times.