Actually, it occurs to me that if the issue was geographical / political, the connectivity issue would probably be bi-directional.
The fact that Caddy is able to reach out to LetsEncrypt and ZeroSSL to request the challenge in the first place (and retrieve error responses when the challenges fail) indicates to me that it’s more likely a misconfigured firewall at a level more localized than that.