Just so you know, both 8.8.8.8 amd 8.8.4.4 are Google's publis DNS servers.
Someone manually configured these, perhaps because they provide better security.
If it is against policy, I would tell the user to stop. Oherwise, you can use SEP 12.1 to block this ability.
I actually use these for my home browsing...