They are very likely keeping track of blocked domains'/DoH servers' IP addresses and have a routing rule that routes packets to those websites to somewhere else

They are very likely keeping track of blocked domains'/DoH servers' IP addresses and have a routing rule that routes packets to those websites to somewhere else, very likely something like "this site is blocked" kind of informational webpage on their servers, but since this is HTTPS the certificates don't match (since the IP department doesn't have the private key of the actual website's certificate) so you get a certificate warning. I wouldn't accept that certificate, and if you have already done so, I'd remove it immediately from my device's certificate store.