I've been at this all day, and it turns out it was the dumbest issue and easiest solution.
I was having the same issue as this post
All DNS queries were being forced to use the pihole which breaks the DNS challenge. The solution was to add the following to the command.
- --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
If there is a better or cleaner way to do any of this I'm open to feed back on my above code through, but otherwise this is solved.