Windows 11 24H2 - 802.1x Authentication not working for certificates generated by NDES server

Machines in our environment that are upgraded to Windows 11 24H2 can not use certificates generated by our NDES server to authenticate using 802.1x against Cisco ISE.

No problems on Windows 11 23H2, they get the same GPO's/Intune Policies as a machine on Windows 11 24H2 would.

The NDES certificate has the certificate hardening Tag so match it to it's AD computer object, not receiving errors on the DC.

If i enroll a machine certificate for client authentication directly from AD using a template, i am able to authenticate without issues.

I don't even see attempts to use the certificate to authenticate in ISE, i only see attempts to use the Mac address, so cannot troubleshoot from there.

Network captures just show EAP failure, no information as to why.

It feels almost as if the PC isn't able to present it's NDES machine certificate for authentication, hence why I'm not seeing it in ISE

Any ideas would be massively appreciated as i'm pulling my hair out over this one, raised a ticket but just sent me links to articles i've read 53909286094 times.