I think a next step will be to distinguish name lookups from basic connectivity (routing). It might not be the very next step, but if you have the procedure ready to go, you can try it at the next failure.
Checking basic connectivity will probably use the 'ping' and 'traceroute' commands. Those used to be available in "Network Utility.app", located in /Applications/Utilities. I've read that Big Sur (or perhaps earlier) no longer has Network Utility, so a Terminal command line is likely going to be needed.
The 'ping' and 'traceroute' should refer to hosts using their IP addresses, not their DNS names. If you used DNS names, then the first thing that happens is a DNS lookup, which means you can't really distinguish name lookup failures from basic connectivity failures.
A useful target host is the example host example.com. It has several alias names, including example.org and example.edu. An example command that pings it 5 times using its DNS name:
Code:
ping -c 5 example.edu
PING example.edu (93.184.216.34): 56 data bytes
64 bytes from 93.184.216.34: icmp_seq=0 ttl=57 time=20.297 ms
64 bytes from 93.184.216.34: icmp_seq=1 ttl=57 time=20.077 ms
64 bytes from 93.184.216.34: icmp_seq=2 ttl=57 time=20.288 ms
64 bytes from 93.184.216.34: icmp_seq=3 ttl=57 time=20.217 ms
64 bytes from 93.184.216.34: icmp_seq=4 ttl=57 time=19.747 ms
--- example.edu ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 19.747/20.125/20.297/0.205 ms
The 1st line shown is the command to paste into a Terminal window. The remaining lines are ping's output.
You can see that the first thing it does is lookup the name to get an IP address. That's a 56-byte packet, and resolves the name to the IP address 93.184.216.34. The remaining lines show each ping, followed by summary data.
If you used example.com, you'd notice it resolves to the same IP address.
You should also do a ping on your local router, so you can tell whether traffic is even getting that far.
The command to do name lookups is 'dig'. It's more complex than ping, so it's best if you read its man page. Same goes for 'traceroute'. Read them with
man dig
and
man traceroute
in a Terminal window.
I recommend practicing different commands until you have one that produces desired info, then storing them in a plain text file, which you can edit in any text editor, including TextEdit. This lets you save predetermined and known-good command-lines in a file, open it in TextEdit, then paste the lines into a Terminal window. Saving them makes duplicating commands exactly at any future time very easy. No remember and type, just copy and paste.
This is a simplified description, and may contain subtle mistakes that would horrify a punctilious network engineer. I'm just describing a few brief things I've used in the past with some success.