Aha, foundryvtt! Now this is something I'm excited about getting fixed 
You want to pass --preffered-chain="ISRG Root X1", like
sudo ./certbot certonly --nginx -d foundryvtt.com --dry-run --preferred-chain="ISRG Root X1"
That should result in the chain which is rooted at ISRG Root X1, and therefore doesn't include ISRG Root X1 in the fullchain.pem itself (chains always stop one cert before the root of trust).