Pi-hole is a network-wide ad-blocking DNS server. iCloud Private Replay is a secure internet relay service. While Pi-hole can protect you from unwanted tracking and advertisements, iCloud Private Relay provides you with privacy when you browse the web in Safari.
When you join the Pi-hole network with a device with iCloud Private Relay enabled, Pi-hole returns NXDOMAIN response for mask.icloud.com and mask-h2.icloud.com as per Apple recommendation.
To disable this feature in Pi-hole and allow the functioning of iCloud Private Relay, go to /etc/pihole/pihole-FTL.conf and set BLOCK_ICLOUD_PR=false.