I looked at how the mozilla VPN was operating.
mozillavpn being based on mullvad it operates mostly as explained in https://ro-che.info/articles/2021-02-27-linux-routing
One notable difference with mozillavpn is the output of the command
ip route list table 51820
All traffic gets routed through the VPN interface moz0 except :
- most ranges in 10.0.0.0/8 (fine, this is a private address space)
- one IP in the 126.96.36.199/24 range (fine, this is the range for the VPN endpoints on mullvad AS https://ipinfo.io/AS3214/188.8.131.52/24)
- and the strange 184.108.40.206 which is hosted in Google cloud.
That IP 220.127.116.11 is (at the moment) what detectportal.firefox.com resolves to, and it's a wifi portal detector service run by Mozilla in Google cloud.
Turns out that if you disable the wifi portal detection in mozillavpn , 18.104.22.168 also gets routed through the VPN.
 eg : preferences > notifications > uncheck "Guest wifi portal alert"