I did just update the firmware yesterday. I don’t remember the version but I think it was v2.6.2. Manually checking for updates reports that my firmware is up to date. Today I no longer see g.live.com in the logs, so the update must be working, thanks!
My work computers are using Zscaler to connect to the work network. Apparently some things are not routing through the VPN correctly and the pcWRT is (correctly) logging the failed DNS look-ups. I’ll follow up with my company IT. I was worried that the pcWRT was somehow overriding the VPN connection and blocking things before they had a chance to be resolved on the company network. But I can access company-private resources using my web browser, indicating to me at least that pcWRT is not the problem here.