When a DNS request is done from any SSID (even with no Captive Portal and Unrestricted Network access) to the hostname, which is also used as subject for the Captive Portal certificate, the AP seems to always return the VC IP address.
The used certificate has a subject which is actually the host name of another server, making it unreachable from any wireless client.
The DNS server for the clients is not the VC, but a Windows server.
Is this behaviour by design?