I looked at how the mozilla VPN was operating.
mozillavpn being based on mullvad it operates mostly as explained in https://ro-che.info/articles/2021-02-27-linux-routing

One notable difference with mozillavpn is the output of the command
ip route list table 51820
All traffic gets routed through the VPN interface moz0 except :
- most ranges in (fine, this is a private address space)
- one IP in the range (fine, this is the range for the VPN endpoints on mullvad AS https://ipinfo.io/AS3214/
- and the strange which is hosted in Google cloud.

That IP is (at the moment) what detectportal.firefox.com resolves to, and it's a wifi portal detector service run by Mozilla in Google cloud.
Turns out that if you disable the wifi portal detection in mozillavpn [1], also gets routed through the VPN.

[1] eg : preferences > notifications > uncheck "Guest wifi portal alert"