The wireshark trace clearly showed that all DHCP was going to/from the pi-hole, so I don’t have any reason to believe there are rogue DHCP servers on my network. Just a possible question of what software on the pi-hole is actually receiving the broadcasts and responding, and I don’t think that can be determined by a network trace, or nmap, at least the output you’re showing doesn’t appear to infer that.
My pi-hole started life as a pi-zero, with raspbian installed specifically to run the pi-hole software. I did nothing to it before or after other than use the Web GUI and change settings, and occasionally ssh into it to update or run other diagnostics. Point being, if AVAHI is installed/running, I don’t believe it was due to anything explicit I did, so I’d expect anyone with a run-of-the-mill install of pi-hole would have the same symptoms, if they were using the DHCP server (probably a small subset…) and they cared about the domain name that was getting handed out (now we’re talking a much smaller subset).
That said, I could certainly uninstall if you think that’s a useful troubleshooting step. And I would have done so, it’s just that the link you provided suggested it was for Ubuntu rather than raspbian/debian, and that’s when I take a pause and ask for clarification
I don’t have nmap on a linux box, but do have “Zenmap” on my windows laptop; running the command there yielded nothing, really:
Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-15 19:36 Eastern Daylight Time
Nmap done: 0 IP addresses (0 hosts up) scanned in 13.13 seconds
WARNING: No targets were specified, so 0 hosts scanned.