Got it! Mark this issue as solved!
Added:
dhcp-option DNSSEC allow-downgrade
dhcp-option DOMAIN-ROUTE .
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
to the bottom of the TEMPLATE.TXT, disabled "systemd-resolved.service" that a previous tutorial advised and BINGO!
Log:
Tested fully using your add-on and we appear to be golden! Thank you so much for all your guidance!
Just 2 things finally and then I'll leave you alone:
1. Notice the "Too few arguments." in the log. What is that? what am I missing?
2. With the VPN disconnected, my resolv.conf reads:
# Generated by resolvconf
nameserver XXX.XXX.XXX.XXX (ISP DNS)
nameserver XXX.XXX.XXX.XXX (ISP DNS)
With the VPN connected it reads:
# Generated by resolvconf
nameserver XXX.XXX.XXX.XXX (PIA DNS)
nameserver XXX.XXX.XXX.XXX (PIA DNS)
nameserver XXX.XXX.XXX.XXX (ISP DNS)
nameserver XXX.XXX.XXX.XXX (ISP DNS)
Is that ok? Should I be concerned that the ISP's DNS is still there?
Anyway, no rush, Im off to configure finish this setup!
Thank you again!