Thank you!
This means, as I suspected, that some locations (the "primary" validation) could connect and confirm your control over the name, but that at least some other locations (the "secondary" validations) could not.
And from those locations, the symptom is a timeout: Meaning that the validation server attempts to connect to your server, but just doesn't get a response in time. Usually, this means that a firewall has blocked it.
You (and/or your network/firewall administration team) may find this FAQ useful, about how Let's Encrypt needs to check from multiple places in order to validate that you actually control a domain name: