@girish I think it was ultimately a disk space issue - I restarted unbound and that seemed to do the trick. I have to move servers again because of a Vultr restriction (block storage not in the zone I had the VM in) that's unrelated to Cloudron so I'll see what happens. Thanks guys!
As for the motivation, we use unbound because the mail server needs to do DNSBL queries. Most of the DNSBL servers like Zen SpamHaus will not respond if the queries originate from Google/Cloudflare DNS. This forces us to run our own DNS server.
The other motivation was also to log DNS lookups by apps to identify any malicious use but we never got around to this (this was initially designed for a setup where we expected all app packages to be done by 3rd party).
Finally, the unbound server should not be used much at all because most of the apps should not be querying anything external.
I followed the recommendations and I managed to fix it.
I tried to do in the application terminal itself.
But it turned out it was necessary to use the server terminal. (feel stupid 😂 )
The problem was with the "Unbound" service.