There's nothing wrong with your site: it serves the alternative certificate chain which chains up to the ISRG Root X1 root certificate. Which should work on most clients which have updated their trust store in the last 5 years.
Your clients running an unsupported version of Windows should at least enable updates which should make sure their Windows 7 has the ISRG Root X1 root certificate in their trust store.