That's only one third of the where you can do strange stuff with certbot.
But the right side does look perfect:
"certbot renew"
[nothing strange going on there]
The other places are in the cli.ini (uncommon but possible)
And in the renewal.conf files (more common)
grep -i hook /etc/letsencrypt/renewal/*.conf