Well, as I previously said, I finally know why it doesn't worked as expected for me, since lines like "listen-on vti0 and listen-on vti1" were missing, for requests incoming from tunneled networks.
However, it seems to be strange that requests are sometimes still forwarded, as we can expect that none are forwarded, or all are forwarded, but why sometimes only some request are forwarded ? This seems to be a bug, however this ticket can be closed since for my needs it's ok...

(By the way, it would be interesting to be able to add more than only one inbound-interface to a NAT rule...)

(And I guess that it's the same reason for NAT rule : the inbound-interface should not only be eth0...)

1. There are no firewall rules set, and no firewall rulset set to the interface on the affected VyOS instances
2. The problems seems to occur whatever the name resolution request is
3. Yes, see below

Yes, I thought about that too, but with or without setting the dns
cache-size to 0, I have the same result !

Ok, thank you for all these details !...