Really thorough setup, and good call including Phishing Army and URLhaus alongside the ad lists. Since you already run Unbound, it's worth knowing it supports RPZ, so you can enforce threat lists right at the resolver too. For homelabs the free lists you picked are plenty. For business networks, scored feeds help because you can choose your own blocking threshold. The WhoisFreaks threat intelligence feeds (whoisfreaks.com/products/threat-intelligence-feed) ship as daily CSV files that load into Unbound or BIND as an RPZ zone. Did you notice any false positives with HaGeZi Pro++?