I ran into this problem and resolved this by changing the agent-tls-mode from strict to system-store.
From the docs:
In
strictmode the agents (system, cluster, fleet, etc) will only trust Rancher installations which are using a certificate signed by the CABundle in thecacertssetting. When the mode is system-store, the agents will trust any certificate signed by a CABundle in the operating system’s trust store.
I suspect that because we have Cloudflare doing TLS termination, the certificate that agents are seeing no longer matches the certificate when getting the certificate from /cacerts.