As the error message suggests, --manual does not permit noninteractive renewal with certbot renew because it requires human intervention to complete the renewal. (In the DNS case, the DNS token that you have to place in the TXT record is different every time, so the existence of the old one won’t permit the renewal.)
You could edit your /etc/letsencrypt/renewal/xxx.com.conf so that the [renewalparams] section looks like this:
[renewalparams]
server = https://acme-v02.api.letsencrypt.org/directory
installer = None
account = xxxxxxxxx
authenticator = webroot
webroot_path = /var/www/xxx/public
and then try running certbot renew again.