I looked at how the mozilla VPN was operating.
mozillavpn being based on mullvad it operates mostly as explained in https://ro-che.info/articles/2021-02-27-linux-routing

One notable difference with mozillavpn is the output of the command
ip route list table 51820
All traffic gets routed through the VPN interface moz0 except :
- most ranges in 10.0.0.0/8 (fine, this is a private address space)
- one IP in the 185.254.75.0/24 range (fine, this is the range for the VPN endpoints on mullvad AS https://ipinfo.io/AS3214/185.254.75.0/24)
- and the strange 34.107.221.82 which is hosted in Google cloud.

That IP 34.107.221.82 is (at the moment) what detectportal.firefox.com resolves to, and it's a wifi portal detector service run by Mozilla in Google cloud.
Turns out that if you disable the wifi portal detection in mozillavpn [1], 34.107.221.82 also gets routed through the VPN.

[1] eg : preferences > notifications > uncheck "Guest wifi portal alert"