Thanks for the confirmation. I wasn’t expecting the tree-climbing to ‘go back’ to the main domain after a CNAME had been climbed.
I forgot to mention in my message that our ns3.monday.vc is also a CNAME pointing to a Heroku Load Balancer, so we cannot add a CAA record to that domain. If I add one to 'monday.vc` it would not be climbed by the validation rules, correct?