Backstory, I operate a couple of public stratum 2 NTP servers that are part of the NTP pool. These then sync to internal stratum 1 NTP clocks.
The issue I have is that clients using the public NTP servers see the internal IPs of the stratum 1 clocks. I'd much rather have something else there, for example the DNS name of the servers. Is this at all possible?
Reference ID is a 32 bit identifier to prevent loops. DNS names you may see are merely an implementation detail of IPv4 addresses being used, plus the convenience of your NTP client resolving them for you.
If the bits look like an IPv4 address and resolve to a name in public DNS, clients will see a name. You can't configure this to an arbitrary string.
To obscure it, have your stratum 1 NTP provide service over IPv6 and have stratum 2 access stratum 1 over that interface. Due to the hashing and other hacks to stuff IPv6 into a 32 bit refid, the address won't be in the packets.
However, realize that obscuring the IP address provides zero additional security. You should be restricting the control protocol to localhost or a local subnet, plus network firewalls.