Thanks for that info! I thought it might be a cron job, but couldnt see anything sounding like letsencrypt or certbot:
cron.d
├── e2scrub_all
├── popularity-contest
└── sysstat
cron.daily
├── apport
├── apt-compat
├── bsdmainutils
├── dpkg
├── logrotate
├── man-db
├── popularity-contest
├── sysstat
└── update-notifier-common
cron.hourly
cron.monthly
crontab [error opening dir]
cron.weekly
├── fstrim
├── man-db
└── update-notifier-common
I installed certbot with snap install --classic certbot on Ubuntu 20.04