Why doesn’t Origin Server certificate *.example.com cover images.example.com

I created a cert for *.example.com,example.com on January 10 and all was well, but a few days ago I found that images.example.com was throwing a 526 Invalid Certificate error.

Looking at my WHM > SSL Hosts I see that images.example.com has a Let's Encrypt cert that expired on August 16, which is about when I noticed it wasn't working so an educated guess is that the LE cert was working instead of the CF cert.

Why?

I verified that images.example.com is proxied at the DNS level so that's not it.