ACM DNS validation stuck in PENDING_VALIDATION for www despite valid public CNAME

I have an ACM public certificate in us-east-1 for:

• bienestarestudiantil.com.ar
• www.bienestarestudiantil.com.ar Managed renewal is stuck in PENDING_VALIDATION only for: www.bienestarestudiantil.com.ar The required DNS validation CNAME exists in the authoritative Route 53 public hosted zone: Name: _9a3fcd2c3482de553279b4b8ca0dc702.www.bienestarestudiantil.com.ar Value: _d3534fa6501faf308bb4cecec17c8f79.jkddzztszm.acm-validations.aws I verified the following:
• The CNAME exists in Route 53.
• The CNAME resolves publicly to the expected ACM target.
• Google Admin Toolbox resolves the same CNAME correctly.
• Public authoritative nameservers match the Route 53 hosted zone.
• There are no CAA records.
• DNSSEC is disabled.
• There is only one record with that exact validation name, and it is a CNAME.
• The existing certificate is ISSUED and in use by CloudFront.
• Certificate.DomainValidationOptions reports SUCCESS for both names.
• Certificate.RenewalSummary.DomainValidationOptions reports SUCCESS for bienestarestudiantil.com.ar but PENDING_VALIDATION for www.bienestarestudiantil.com.ar. I also verified the validation CNAME directly against Google Public DNS (8.8.8.8). It resolves correctly and does not return SERVFAIL, so a broken DNSSEC chain does not appear to be the cause. I also requested a completely new ACM certificate for the same two names. ACM reused the same DNS validation tokens and the new certificate also validates the root domain successfully but remains PENDING_VALIDATION for www. No DNS changes were made before the renewal failure. Is there any known condition that could cause ACM to reject or fail to re-evaluate this specific DNS validation token even though the CNAME is publicly resolvable and correct? The current certificate expires on 2026-10-06, so this is time-sensitive.