Were you leaking ipv4 or ipv6? Both? I don’t think Proton supports ipv6, so you’re better off disabling it system-wide.
I know protonvpn-cli and protonvpn gui try to block ipv6 traffic by default, but conceivably it could have failed for some reason (some error you could see in the program output).
Those sites use all sorts of methods to get your browser to do stuff like make DNS requests or connect to online resources outside standard requests, like using the OS handle tasks that browsers should not do by default.