You mentioned using a Palo Alto.
We just experienced the same "Connection reset by peer" issue, where previously renewal has worked perfectly, and upon checking our Palo Alto firewall it's recently started blocking the acme-protocol "application" in its settings with the default deny rule. So I'd suggest checking your firewall in case the same has occured.