Certonly --force-renewal

Almost never. It used to be more helpful before the reconfigure command was created.

What if you run certbot renew --dry-run

You should be using --dry-run instead of production anyway when testing your hooks.

Let's Encrypt caches authorizations and I believe Certbot only calls those hooks when a new auth is needed. See the LE docs about profiles for the cache duration: Profiles - Let's Encrypt

The --dry-run will deactivate prior valid auths so new ones are then needed