How to test service bus is fully private

[erwelch]

I'm having problems verifying my Service Bus is fully private after adding the private endpoint. I can do the nslookup inside the VM and get this:

But I have services outside of the VNET that are still able to access the Service Bus (specifically an Azure Functions with a Service Bus trigger). Any tips on checking if the Service Bus is private to the VNET? Azure Storage I can verify through the Azure Storage Explorer or even through the portal - anything similar with Service Bus?