It seems there's substantial delay, but it does eventually propagate. After almost 24h I'm now seeing the cert being served from both CDNs I was updating. It may be the case that doing invalidations on the / path helps as the other one that I did that came through already yesterday, whilst for the CDN I had to give over night.
反映に時間かかる
DNS検証
AWS Certificate Manager(ACM)による証明書の自動更新について勘違いしていたのでまとめ - Qiita
https://qiita.com/VTRyo/items/9534c73ff300ff721056
