[cach]   => NSEC sname: covered by: pccw. -> pe., new TTL 83379

i.e. kresd has a record from the root zone proving that there's no .pcsd TLD, so it answers NXDOMAIN.  Usually it doesn't get such a record at start, and it might obtain a positive record that takes precedence, too, so it's easy to get confused... combining contradictory records is just tricky.  I expect you can configure these particular TLD names - see docs for details: https://knot-resolver.readthedocs.io/en/latest/modules.html#replacing-part-of-the-dns-tree

--Vladimir