I have a way to solve your problem only thing is it’s going to kill your battery life.

Apps I used to have 2 “vpns”

First Insular or Shelter use one of them to create a work profile.

Apps inside of The Work Profile Exclave VPN APP of choice for example MullvadVPN

Apps outside of The Work Profile Tracker Control PersonalDNSfilter

What I did is that i configured Tracker Control to send all DNS requests to the locally running DNS service that Personal DNS Filter creates as well as telling Tracker controll to not capture trafic from Personal DNS Filter. I also then configured Personal DNS Filter to use Mullvad DNS witg DoH or DoT. Then i configured Tracker control to send all traffic to a socks5 proxy (that is created by Exclave) that way the traffic from a app goes like this.

All traffic that isn’t DNS App —> Tracker contol —> Exclave —> MullvadVPN

DNA traffic App —> Tracker control —> Personal DNS Filter —> Mullvad DNS

Look I had this for a while and I don’t recommend it due to the battery drain. Remember this setup will use 2 VPN slots run 4 services. A DNS proxy, a full socks5 and A wireguard VPN at the same time as a complete work profile. Good luck tho!