Hello all...
just for the records: Problem has been identified and fixed.
The cause: We have a mixed configuration on that specific server, partially built by ispconfig software and manual additions. The server in question is manually added while a server config in ispconfig was still present, but disabled.
ispconfig has a configuration option called "Revoke a certificate before deleting it (prevents Let's Encrypt renewal warnings)';" which has been triggered for some reason we don't yet know, but it was indeed ispconfig's internal certbot process that actively sent a revocation before removing the corresponding certificate.
Thanks for all the pointers, they helped me look in the right direction and finally managed to find the reason for this 