This — DNS is one of the primary identifiers for geo fingerprinting — ISPs move address spaces around, but AnyCast DNS will return the closest physical CDN/server offering the content typically — you need to ensure the DNS lookups are also hitting the tunnel