Some months ago, I had UTD issues with Element X too. My hs has been up for some years, and the devs claimed they had done a lot to fix UTDs.
I was about to bring the server down, but as a last resort decided to log out all but one Element web session which was able to decrypt the messages and try resetting the key backup. Haven’t had any UTD issues since then.
Maybe worth a try.







Maybe that particular subdomain is getting treated as the default virtual host by Apache? Are the other subdomains receiving scans too?
I don’t use Apache much, but NGINX sometimes surprises on what it uses if the default is not specifically defined.