We just ran into this testing web filtering with Cloudflare DNS. You are correct that iCloud Private Relay bypasses the configured DNS servers, but there is another spot - the "Advanced Tracking and Fingerprint Protection" that is a setting in Safari (Settings, Safari, Advanced Settings.) It is on by default for the Private Mode browsing.
The posting links to the blog post about the tool, but if you click on Mac Monitor at the bottom of the page under Products and Solutions it takes you to the actual page for the tool and that page has the big red download button everyone is talking about..
My iPhone 12 pro Max, with the latest iOS, picked up all four. The first three fairly easily, the last one I had to keep moving the phone in and out before it showed. That said, none of them kept the link constantly and it was a bit tricky to hold it still enough once it found the link to tap it. (The link was to a YouTube video about QR image codes..)
My iPhone Xs eventually got the green guy to recognize, but not the Pikachu or the little RPG guy or the whatever the other thing is.
This would be a really cool idea if it could be made to work reliably. I like how Twitter did it, they put your avatar in a small circle in the center. That seems to work.
