I looked at how the mozilla VPN was operating.
mozillavpn being based on mullvad it operates mostly as explained in https://ro-che.info/articles/2021-02-27-linux-routing
One notable difference with mozillavpn is the output of the command
ip route list table 51820
All traffic gets routed through the VPN interface moz0 except :
- most ranges in 10.0.0.0/8 (fine, this is a private address space)
- one IP in the 184.108.40.206/24 range (fine, this is the range for the VPN endpoints on mullvad AS https://ipinfo.io/AS3214/220.127.116.11/24)
- and the strange 18.104.22.168 which is hosted in Google cloud.
That IP 22.214.171.124 is (at the moment) what detectportal.firefox.com resolves to, and it's a wifi portal detector service run by Mozilla in Google cloud.
Turns out that if you disable the wifi portal detection in mozillavpn , 126.96.36.199 also gets routed through the VPN.
 eg : preferences > notifications > uncheck "Guest wifi portal alert"