There’s a few parts to this. First off, whatever is configured as an DNS server under the currently in use network adapter as seen by your operating system, whether it is being obtained by DHCP or statically assigned. This is where your OS will look to for DNS results. Now as a sub note to this, your VPN software will most likely carry a higher metric within the operating systems network stack. Meaning if it is connected, your OS will then use which ever settings are being dictated by the VPN software.
This is how a lot of VPN software can get around region blocking, Geo blocking, etc.
Back to the operating system without the VPN connected — If your DNS server is your router, your computer is going to ask your router, look up “domain.com”. If your router knows that entry, it will then return the IP address to your computer. If it does not, then it will send it to which ever DNS servers are configured within the router. In this scheme, your router is acting as a DNS server and cache.
Most of the time, on usual ISP installed environments, your DNS servers configured in your router could be your ISPs DNS servers.
Long story short, think of it as a tree layout. If your computer doesn’t know, it asks the next step, so on and so forth. Now, if you explicitly defined services such as Cloudflare or Google DNS within your operating systems, currently in use network adapter, your computer would then just directly ask those DNS servers for its results.
