Let’s Encrypt promotes the first eligible domain from the CSR to the CN, unless a CN is provided in the CSR. The names are eventually sorted to produce the SANs in the certificate. There was an unintentional change in 2023 that used the sorted list instead but that was quickly reverted.
(Eligible: has to be short enough to fit in a CN)