You can actually buy "Passive DNS" records. Big DNS providers collect all the answers they learned while serving, deliberately without recording who asked and the answers are aggregated and available for purchase.

So if Sarah in accounts once went to secret-webserver.internal.example.com from her laptop at home before turning on the VPN by mistake, her upstream DNS provider will tell any attackers with some $$$ that secret-webserver.internal.example.com existed, when it existed, what the A or AAAA records said and so on.

Targeted attacks will know about secret-webserver.internal.example.com even though only *.internal.example.com is listed in the CT logs.