There's an uncommon but painful issue where nameserver replication hasn't completed yet, because maybe the nameservers mirror as a scheduled task and it hasn't run yet. We usually see that as something like example.com having nameservers listed as ns1 and ns2.example.com, and while the TXT record (or CNAME delegation) exists in ns1, it hasn't appeared in ns2 yet. Since Unbound randomly chooses the nameserver, there's then a 50/50 chance of failure.
It'd be great if letsdebug could query each nameserver and raise the issue of them being out-of-sync.