When I have newbie-questions, I always like to hear how “it’s actually done”, maybe even different versions from multiple people. So I want to elaborate a little bit on the good answer by Sapiens (arch wiki solves almost always all)
Forcing usage of the VPNs DNS servers is a feature that some providers and/or clients bring with them. You will find a toggle in the client, or a line like dhcp-option DNS 10.11.12.13 in your .ovpn config if that is the case. You can test its effectiveness with a service like https://ipleak.net/, which is provided by AirVPN, an italian company that promotes net neutrality, privacy and defense against censorship.
That’s usually a means to enable VPN clients (like employees that are in the field) to find internal network services via their hostname, like dashboard.mycompany.local or printer3mainoffice, which is only known to the DNS servers in that specific local area network and only accessible via LAN. If you don’t need that functionality, the DNS setting is not touched, as you suppose that your device in Baghdad is configured to a more performant DNS-server than your server from '98 that sits in Nebraska.
If you trust your VPN provider to be the single 3rd party entity that sees all your network activity, and could potentially log everything, linking to you as a legal person, you can also use that feature to encrypt any traffic, including DNS queries, hiding it from your ISP and whatever DNS you usually use, like Google or Cloudflare.
As Sapiens wrote, you can manipulate your DNS server settings. Since you are on Pop!_OS, which uses GNOME (as do I), you can tweak those settings easily per connection in the Network Manager GUI.
But I would not do that. It’s far too cumbersome. You will forget you tweaked that setting, forget to set it on your other network adapters or new clients, maybe you get an error some time and don’t think of this tweak as a potential cause. It is an unnecessary potential for problems.
Correct me if I am wrong: Practically and usually, DNS settings are set on a network-level basis. Only very special edge-cases could warrant the overhead of specific DNS settings on a per-client-basis. And even that I would configure on the network equipment, with a special rule for this MAC-device-client or something, so it’s all in one place.
You can fiddle around with stuff like GRC | DNS Nameserver Spoofability Test , or see to it that any DNS queries leaving your local area network are TLS-encrypted, nothing is (geo-)censored, and you have the best performance possible to satisfy your concerns. There are many knobs you can turn. But you can not trust any external provider to not log your activities and use that data against you, you can not trust any external service to always be the same, e.g. uncensored. A server from an elite group called privacy-knights can be hacked and used against you by russian hackers. There is no way to do it “right”, and transparently so, except to do it yourself 100%. That way you could realize your very good idea of a big list of reliable, fast and maybe even kind of trustworthy DNS servers, which are randomly queried, to serve your actual DNS requests from local network clients.
I would describe myself as very privacy-conscious. My network clients use the gateway for DNS and my gateway devices have something OpenDNS, Quad9 or a mixture of some smaller, privacy-focussed providers from lists like Best Free & Public DNS Servers List or articles like https://www.privacy-handbuch.de/handbuch_93d.htm which are almost always outdated.
So in short summary, for everyday network traffic I rely on the big but not biggest players and when I want something to be private it gets special treatment. That’s my compromise for being yet too lazy to build my own local DNS infrastructure.
Like many other topics about values that don’t earn anybody money, like privacy, and are not as popular as they should be (“I never even noticed that they collect data about me, nor do I care”), it comes down to finding and setting a limit to your expenses on this particular endeavor, when it is good enough for you.
