No, I don't think snap Certbot will help.
There is a way to remove a single cert from the CA root store. But, I don't know Arch and pacman well enough to instruct. Maybe an Arch forum could guide?
Further, that ISRG/DST cross-sign is not even a root and should never have gotten into that CA root store. I don't know if that's something unique to your image template or Arch itself. But, you need to figure out how to (re)build your CA store properly.