What other subsystems are responsible for enabling IPv6 in when it has been disabled in sysctl.conf, and how can I track which one is enabling it?

Although I have disabled IPv6 in sysctl.conf (Debian 11), connecting my main switch to an IPv6 enabled router results in IPv6 addresses being allocated on Debian interfaces and I can ping and SSH to them from external IP addresses. The original problem is discussed in https://unix.stackexchange.com/questions/776581/why-are-ipv6-address-being-assigned-although-ipv6-has-been-disabled . Normal internet connection is via a box which connects to the router via wireless and is also connected to the main switch. It is the gateway for all the systems and runs the VPN. The router normally has no direct connection to the main network switch. The problem comes when I connect the router directly to the main switch so the box acting as the gateway can get a higher performance over the wired connection compared to the wireless. Because IPv6 is disabled in /etc/sysctl.conf I don't expect IPv6 to be enabled at all, but it seems Debian has different ideas and whether via DHCPv6 or some other mechanism all the systems are allocated IPv6 addresses. This results in internet connectivity going directly through it the router and bypassing the IPv4 based VPN, resulting in a lot of Cloudflare checks and some websites not working properly until I disconnect the cable connecting directly from the switch to the router and restart networking on the systems or reboot them altogether. Checking whatsmyip.net displays my local IPv6 address and this is something I definitely don't want. I suspect it may be possible to configure something on the router to disable the IPv6 though, but I'd rather leave that alone and disable it in the Debian configurations. Are there other network services or some kernel features that bypass /etc/sysctl.conf and enable IPv6 to come up, either by DHCP or some other mechanism between Debian and the router? PS. The systems involved are all Debian 10 and 11.