Without looking at it it’s probably making a unique request to a resource on a NextDNS subdomain and watching where the request comes from. Like pulling an image from (unique _string).check.nextdns.com. This requires nothing special on the client, it’s making a standard request, and as part of that it needs to do a DNS lookup.

If the source of the and your IP are similar then it’s likely the same network, otherwise it can correlate the source with known resolvers.

I use HASS.agent to help manage my Windows desktop and expose various sensors to HA. It can suspend or hibernate the system. It does use MQTT as its connectivity plane.

You get easy access to their addons with a VM (aka HAOS). You can do the same thing yourself but you have to do it all (creating the containers, configuring them, figuring out how to connect them to HA/your network/etc., updating them as needed) - whereas with HAOS it generally just works. If you want that control great but go in with that understanding.