Its probably using a check to ping google or something. Can you put adguard or pihole in front and see whats its trying to connect to. Or you could try tcpdump to inspect the raw traffic.
Maybe a dns rewrite could sort it or use ethernet or tplink like plugs









Looks nice. Well done!