RDP wouldn't be something you can easily determine by its DNS queries; often, RDP skips DNS altogether when connecting by IP. They could identify services using RDP, like Windows 365, that always use the same domains to initiate connections.