Please stop making up “theories” to fit the limited observations you’ve had. They just don’t fit the facts. Please spend some time perusing this forum and/or the official documentation. SD cards aren’t used to buffer cloud recordings. There is no 4 second recording before a motion event. I’m not going to address each point further because frankly you’re kind of just making them up.
Perhaps some of the other regulars will have more patience to explain.
Unfortunately this tangent is detracting from the valid concerns raided about the excessive DNS queries.
Edit: here are a couple of old threads that may help; the information is still mostly valid
