limond

Well, I had only little time to dig further but I can confirm your findings that OpenVPN alone behaves as it should while the NordVPN client acts differently. However, wireshark says I am only communicating with the NordVPN server when connected through their client. I would love to know where the difference in configuration is. I always assumed NordVPN would just call OpenVPN with the public ovpn configs. They call the OpenVPN client with a config that is shortly deleted after OpenVPN starts but can be extracted when swapping the openvpn binary. It looks unsuspicious. A management unix socket is opened to control the OpenVPN client. I would like to know how the communication is configured.

I used the NordVPN CLI client version 3.4.0-1 from a Debian bullseye PC

EDIT: package from https://repo.nordvpn.com/deb/nordvpn/debian/pool/main/

I was testing this earlier with a NordVPN US server. Akamai sees a changing IP (different from the public IP of the server) that seems to be in residential ISP IP blocks when retrieving www.disneyplus.com. For other sites on the Akamai CDN this was not true. On other sites header and public IP matched like in your example.