One solution could be to make a DNS request for a random label at the leftmost position. In this case, it would be [RANDOM].test.api.app.uca.edu.ar
like:
tjhsrs.test.api.app.uca.edu.ar
If this request FAILS, then SKIP the on-demand test alltogether.
Why this would work:
The recursive issuance is based among a DNS wildcard connected to a web server, which gives the endless labels.
By testing for a DNS wildcard, by trying to look up a domain that WOULD EXIST if the DNS set up would be like *.uca.edu.ar, then you defend against recursive on-demand TLS, while still allowing legit domains with many different "BlockedLabels" to exist.
By requiring [RANDOM].test.api.app.uca.edu.ar to fail, you effectively test for wildcard.
This would COMPLETELY block on-demand issuance - since if theres no DNS record for the extra label (like git.api.test.example.com) then the request would not reach the on-demand TLS server.
this would also resolve this:
Without actually causing more spam domains.