iCloud Private Relay disables Quad9 / NextDNS and offers no malware protection

They only mentioned that the solution Apple came up with (NextDNS worked together with Apple on this) will duplicate DNS, so it probably filters first and then forwards to the relay. That’s why you will see both your NextDNS server and Apple’s partner networks on sites like https://browserleaks.com/ip. NextDNS mentioned the solution wasn’t ideal (because some features don’t work, like the block page, DNS rewrites and the green status icon) and that they also proposed another one, but it’s up to Apple to change. Overall, I have not seen any issues in the last months when using them together.