/run contains all sorts of virtual stuff, it doesn’t persist over a reboot,

I would advise against deleting anything in it as those files are used by programs running as whether user has the ID of 1000 (most likely you)

it contains things such as sockets and lock files so that programs can interact with each other

so it would be like you say I want Firefox to go thru the tunnel, you would want the DNS requests made from it to go thru as well, in this case they weren’t tunneled and were just going to the normal dns server