When using a VPN, DNS queries are supposed to go through the VPN tunnel so that only the VPN service can see and resolve them. A DNS leak occurs when a DNS request is somehow routed outside the VPN tunnel so that it can be seen by (and usually also resolved by) your ISP.   There are a number of reasons this can happen, and while Windows tends to be the worst offender, it can happen on any platform. DNS leak protection solves the problem by using firewall rules to ensure no traffic can leave your device outside the VPN tunnel.