Welcome to the community @jmcgranahan
First off, you look to be a victim of a Palo Alto brand firewall. They recently changed a default setting which is blocking the ACME challenge path URLs. See below post for details on correcting that. Requests to your domain fail in the same way as these others with "reset by peer". This was likely the reason your cert did not renew a month ago.
Your other problem is you have a corrupt set of Let's Encrypt folders. There is an error saying a file should be a symlink but it is not. I don't have time at the moment to help with that but either someone else will pickup or I might later tonight.