So I noticed something interesting. Access control works but only with devices on the 5 Ghz band, devices on the 2.4 Ghz can still access sites on the target list. Not sure why that is, both 5Ghz and 2.4 Ghz are of the same sub-net. Couldn't find any wireless settings that will enable/disable access control per frequency either.

So I tried connecting to the different networks and the problem stayed with the devices not the networks (5 Ghz & 2.4Ghz). For example:

Device 192.168.0.100 was originally on the 5 Ghz and could not get on Facebook (access control working).
Device 192.168.0.101 was originally on the 2.4 Ghz could get on Facebook (access control not working).
Connected 192.168.0.100 to the 2.4 Ghz
Connected 192.168.0.101 to the 5 Ghz.
Device 192.168.0.100 still is not ableget to Facebook on the 2.4 Ghz
Device 192.168.0.101 can still get to Facebook on the 5 GHz.

WTH?!

I doubt it's caused by the DNS cache of the browser on device 192.168.0.101.
With the cache, 192.168.0.101 doesn't need to request for the IP address of facebook.com but access it directly with the IP address stored in the cache.
So it's recommended to clear the browsing history on the browser and on the device and try again.

I've tried that previously. Tried it again as well, still does not work. I've also tried turning off 192.168.0.100 and changing 192.168.0.101's IP address to 192.168.0.100, still nothing.

Clear the browser cache is not enough, you need to clear the cache in the device at the same time.
For example, if you have a windows OS computer, please open the command box, then type in ipconfig -flushdns.

Flushing the local DNS cache didn't do it, access control still does not work. I tried adding other domains to the target list also. The same devices that can reach Facebook can still get to all the domains on the list; the devices that couldn't get to Facebook can't reach any domains on the list.

Fixed the issue, it ended up being related to IPv6. I disabled it within the router and the problem went away.

Kudos to TP-Link's tech support!

Great! I found I missed the screenshot you share before. The computer must be browsing facebook.com via its ipv6 address.