I upgraded to 3.0.7, renewed certs, now all is good.
I don't quite understand why this works, though. The temporary misconfiguration mentioned here (Shortening the Let's Encrypt Chain of Trust - #2 by aarongable) would explain the problem I was originally seen, but I don't understand why after force renewing certs on another host today also got the short chain.
Anyway upgrading to 3.0.7 and force renewing seems to have fixed the problem. Thanks!
Guillermo