InTune - AD only joined device - User certificate not installed

We configured Enrolling On-prem CA SSL certs to Azure only joined devices last year and it worked until today.

Failed to process PKCS request.

Certificate Authority: ca.example.com\ca
Certificate Template: AzureADUser
Subject Name: CN=some user,DC=example,DC=com,E=email address removed for privacy reasons
SAN: <SANs><SAN NameFormat="33554432" AltNameType="11" OID="1.3.6.1.4.1.311.20.2.3">

</SAN><SAN NameFormat="67108864" AltNameType="2" OID="1.2.840.113549.1.9.1">email address removed for privacy reasons</SAN></SANs>

System.InvalidOperationException: IssuePfx - The submission is pending

Disposition string: Taken Under Submission
Disposition number: 5
Last Status: 0
at Microsoft.Intune.Connectors.MicrosoftCA.GetCertificate(PkiRequestMessage pkiRequestMessage)
at Microsoft.Intune.Connectors.PkiCreateProcessor.ProcessPkiRequest(Guid activityId, PkiRequestMessage pkiRequest, DateTime receivedTime)

Below is Intune enrollment