It appears that (at least some) Windows 7 systems don't have the Let's Encrypt root (ISRG Root X1) installed, or if installed it isn't working properly there. But unless you somehow have a special support contract with Microsoft for your old Windows 7 systems to try to see if they have some automatic trust store update that can be enabled, I don't think there's much you can do other than have the users manually install the trusted root.