You can always not use those sites and/or only print the ones that have picture and ignore the others. People are offering hours if their work for free (including a bunch of prototypes and wasted plastic you never see), including licensing them sometimes very generously, and you come complaining that there isn’t a picture? If you can’t look at a model you won’t be able to tell if the uploaded pictures are from the same version of the model uploaded.

If all traffic is going through your homelab you can make the vpn clients use a vpn specific DNS server or the one suggested with resolving per origin, you then make the external names to your services to resolve to the servsrs’ internal IP addresses, avoiding going out. Another way is to add rules to your gateway to redirect internal traffic going to your external IP addresses to DNAT to the internal addresses but in order for that to work you need to masquerade them which means server logs will have gateway’s IP.